feat(node): Phase 11 — production-ready daemon with WebRTC, WS, chat, HTTP

The node daemon was previously a skeleton that only started QUIC/TCP
servers and the local web UI. All browser-facing functionality (WebRTC,
hub WebSocket, chat store, HTTP file API) lived in QE demo scripts.

This rewrites daemon.py to be fully self-contained:
- WebRTC transport for browser clients (aiortc DataChannel)
- Hub WebSocket task (signaling, revocations, WebRTC offers)
- ChatStore per group (SQLite in ~/.local/share/meshbay/)
- HTTP file API per group (create_http_app on configured port)
- Graceful shutdown (all transports, stores, tasks)
- hub_client: _ws tracking + send_ws() for chat notifications
- config: data_dir field for persistent state
- systemd: security hardening (ProtectSystem, StateDirectory)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/config.py b/packages/meshbay-node/src/meshbay_node/config.py
index c28105f..9e6a391 100644
--- a/packages/meshbay-node/src/meshbay_node/config.py
+++ b/packages/meshbay-node/src/meshbay_node/config.py
@@ -93,6 +93,7 @@ class Config:
     node:     NodeConfig     = field(default_factory=NodeConfig)
     groups:   list[GroupConfig] = field(default_factory=list)
     keystore: KeystoreConfig = field(default_factory=KeystoreConfig)
+    data_dir: Path = field(default_factory=lambda: Path.home() / ".local" / "share" / "meshbay")
 
     # Back-compat: single-group access
     @property
@@ -140,6 +141,9 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
                 name=grp.get("name", ""),
             ))
 
+        if "data_dir" in raw:
+            cfg.data_dir = Path(raw["data_dir"]).expanduser().resolve()
+
         ks = raw.get("keystore", {})
         if "path" in ks:
             cfg.keystore.path = Path(ks["path"]).expanduser()