Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 14 insertions, 1 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/config.py b/packages/meshbay-node/src/meshbay_node/config.py
index b1ebd54..78ee873 100644
--- a/packages/meshbay-node/src/meshbay_node/config.py
+++ b/packages/meshbay-node/src/meshbay_node/config.py
@@ -36,7 +36,10 @@ url      = "https://meshbay.org"
 username = "myusername"
 
 [node]
-quic_port = 19010  # QUIC (MNP) — LAN, port-forwarded, hub-less direct access
+# QUIC (MNP) direct path — LAN, port-forwarded, hub-less. Off by default: no
+# client speaks QUIC yet, so leaving it on only opens a UDP port.
+quic_enabled = false
+quic_port = 19010
 ui_port  = 18000   # local control API — JSON, 127.0.0.1 only, token-gated
 
 # One-time codes. An invitation waits for someone to read their messages; an
@@ -129,6 +132,13 @@ class HubConfig:
 @dataclass
 class NodeConfig:
     quic_port:  int = 19010
+    # The QUIC MNP listener. Off by default: no shipping client speaks QUIC yet
+    # (the browser and the desktop client use WebRTC; the hub-less `group://`
+    # sidecar is unbuilt), so starting it only opens a UDP port with nothing to
+    # reach it. Turn on for LAN / port-forwarded / hub-less direct access once a
+    # client for it exists. `punch_nat()` is a direct-connection helper, not a
+    # NAT-traversal stack — a peer behind NAT still needs the port forwarded.
+    quic_enabled: bool = False
     ui_port:    int = 18000
     # How long a one-time code stays usable. Invitations travel through a human
     # conversation and are answered days later; operator pairing happens during
@@ -303,6 +313,7 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
         # `port` (TCP+TLS) and `http_port` no longer exist — both listeners were removed
         # in Phase 11.5 (findings C1, C6). Regenerate node.toml with `meshbay-node init`.
         cfg.node.quic_port = nd.get("quic_port", cfg.node.quic_port)
+        cfg.node.quic_enabled = bool(nd.get("quic_enabled", cfg.node.quic_enabled))
         cfg.node.ui_port   = nd.get("ui_port",   cfg.node.ui_port)
         cfg.node.invite_ttl_hours = int(
             nd.get("invite_ttl_hours", cfg.node.invite_ttl_hours))
@@ -371,6 +382,8 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
         cfg.hub.username = user
     if port := os.environ.get("MESHBAY_QUIC_PORT"):
         cfg.node.quic_port = int(port)
+    if (qe := os.environ.get("MESHBAY_QUIC_ENABLED")) is not None:
+        cfg.node.quic_enabled = qe.strip().lower() in ("1", "true", "yes", "on")
     if streams := os.environ.get("MESHBAY_MAX_CONCURRENT_STREAMS"):
         cfg.node.max_concurrent_streams = _positive(
             streams, cfg.node.max_concurrent_streams,