Merge branch 'fix/third-review-h1-h2-m1-m6'

Third security review (docs/third-review.md) plus its remediation.

Fixed and verified:
- H1  moderator could grant admin / hard-revoke  → handler split by field
- H2  unauthenticated 2-report global blocklist  → auth + distinct reporters
      + rate limit + refused when public groups are off
- M1  registration reCAPTCHA was inert           → gate unconditional; the
      desktop client's CSP allows the widget
- M2  QUIC chat/stream handlers lagged WebRTC    → brought to parity; the QUIC
      listener is now off by default ([node] quic_enabled)
- M3  link-preview SSRF gaps                      → rate limit + port allowlist
      + connect-address re-check + decompression-bomb guard
- M4  federated peer over-trust                   → source bound to the signer,
      push capped, revocation prunes the peer's own entries, replay rejected
- M5  no CSP / security headers on the SPA        → middleware; verified against
      the live app with no violations

Withdrawn:
- M6  add_group_member accepting node tokens is deliberate (commit 0443cf8,
      the CLI invite flow). The "fix" broke that flow on the deployed hub and
      was reverted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

1 files changed, 8 insertions, 1 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index 056371a..8f9307c 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -537,7 +537,11 @@ class NodeDaemon:
                 log.warning("WebRTC not available (aiortc not installed)")
 
             # 7. QUIC chunk server (LAN / port-forwarded / hub-less direct access)
-            if QUIC_AVAILABLE:
+            #
+            # Off unless `[node] quic_enabled = true`: no shipping client speaks
+            # QUIC (browser and desktop use WebRTC; the `group://` sidecar is
+            # unbuilt), so starting it by default only exposes a UDP port.
+            if QUIC_AVAILABLE and self._config.node.quic_enabled:
                 self._quic_server = QuicChunkServer(
                     sk_node=keys.sk_ed25519,
                     hub_pk_pem=session.hub_pk_pem,
@@ -553,6 +557,8 @@ class NodeDaemon:
                 await self._quic_server.start()
                 log.info("QUIC server on port %d (%d groups)",
                          self._config.node.quic_port, len(groups_ctx))
+            elif QUIC_AVAILABLE:
+                log.info("QUIC server disabled ([node] quic_enabled = false)")
 
             # 8. Hub WebSocket (signaling + revocations + WebRTC offers)
             async def on_webrtc_offer(sdp, peer_id, ice_candidates):
@@ -1708,6 +1714,7 @@ def main() -> None:
                 f'username = "{username}"',
                 "",
                 "[node]",
+                "quic_enabled = false  # QUIC direct path; no client uses it yet",
                 "quic_port = 19010",
                 "ui_port   = 18000",
                 "",