feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth

Baseline commit capturing in-progress Phase 12 work that was already present
in the working tree (uncommitted) before the Phase 11.5 security remediation
begins. Committed as-is, without review or modification, so that remediation
changes arrive as a separable diff.

Contents: BundleStore (P2P GEK + keypair bundles), password split
(auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped
JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin
challenge-response, node local admin UI rewrite, browser key persistence.

Not authored in this session — captured to establish a baseline.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 9 insertions, 3 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/config.py b/packages/meshbay-node/src/meshbay_node/config.py
index 9e6a391..a7a0785 100644
--- a/packages/meshbay-node/src/meshbay_node/config.py
+++ b/packages/meshbay-node/src/meshbay_node/config.py
@@ -52,6 +52,11 @@ visibility  = "public"
 [keystore]
 # unlock_file = "~/.config/meshbay/unlock.key"
 # or set MESHBAY_UNLOCK_KEY env var
+
+# Node sovereignty: pin the operator's Ed25519 public key (base64, 32 bytes raw).
+# Admin operations (file delete) require cryptographic proof of this key.
+# Auto-pinned on first startup from the node operator's keystore.
+# admin_pk_ed25519 = "base64-encoded-32-bytes"
 """
 
 
@@ -59,7 +64,6 @@ visibility  = "public"
 class HubConfig:
     url:      str = "https://meshbay.org"
     username: str = ""
-    password: str = ""   # loaded from keystore or env; never written to TOML
 
 
 @dataclass
@@ -94,6 +98,7 @@ class Config:
     groups:   list[GroupConfig] = field(default_factory=list)
     keystore: KeystoreConfig = field(default_factory=KeystoreConfig)
     data_dir: Path = field(default_factory=lambda: Path.home() / ".local" / "share" / "meshbay")
+    admin_pk_ed25519: str = ""  # base64 raw Ed25519 public key pinned locally
 
     # Back-compat: single-group access
     @property
@@ -144,6 +149,9 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
         if "data_dir" in raw:
             cfg.data_dir = Path(raw["data_dir"]).expanduser().resolve()
 
+        if "admin_pk_ed25519" in raw:
+            cfg.admin_pk_ed25519 = raw["admin_pk_ed25519"]
+
         ks = raw.get("keystore", {})
         if "path" in ks:
             cfg.keystore.path = Path(ks["path"]).expanduser()
@@ -155,8 +163,6 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
         cfg.hub.url = url
     if user := os.environ.get("MESHBAY_USERNAME"):
         cfg.hub.username = user
-    if pwd  := os.environ.get("MESHBAY_PASSWORD"):
-        cfg.hub.password = pwd
     if port := os.environ.get("MESHBAY_PORT"):
         cfg.node.port = int(port)