feat: Phase 9.1–9.5 — WebRTC DataChannel transport for browser P2P

Browser clients can now connect P2P to nodes behind residential NAT via
WebRTC DataChannel with ICE/STUN. Validated on SFR Port-Restricted Cone
NAT + 4G CGNAT across three scenarios (WiFi LAN, 4G IPv6, 4G IPv4 STUN).
No TURN relay needed. Hub serves only as signaling relay (<1 KB).

New files:
- webrtc_server.py: aiortc-based WebRTC transport (node side)
- signaling.py: SDP/ICE relay endpoint (hub side)
- transport.js: browser WebRTC client with msgpack framing
- webrtc-test.html: spike test page for browser→NAT→node validation
- test_webrtc_transport.py: 4 tests (handshake, file transfer, auth, guard)
- meshbay-draft-v4.md: architecture spec updated for web client

Modified:
- hub_client.py: WebRTC offer handling via hub WebSocket
- revocation.py: node_id from WS auth + webrtc_answer routing
- pyproject.toml: aiortc>=1.9 dependency

123 tests passing (117 existing + 6 new).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 15 insertions, 1 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/hub_client.py b/packages/meshbay-node/src/meshbay_node/hub_client.py
index 74851c1..3e77ed0 100644
--- a/packages/meshbay-node/src/meshbay_node/hub_client.py
+++ b/packages/meshbay-node/src/meshbay_node/hub_client.py
@@ -250,10 +250,11 @@ class HubClient:
         self,
         on_incoming: Any = None,
         on_revocation: Any = None,
+        on_webrtc_offer: Any = None,
     ) -> None:
         """
         Maintain a persistent WebSocket connection to the hub.
-        Receives NAT punch requests and revocation tokens.
+        Receives NAT punch requests, revocation tokens, and WebRTC offers.
         Runs until cancelled.
         """
         import websockets
@@ -270,6 +271,7 @@ class HubClient:
                     await ws.send(json.dumps({
                         "type": "auth",
                         "token": self._session.access_token,
+                        "node_id": self._session.node_id,
                     }))
                     auth_resp = json.loads(await ws.recv())
                     if auth_resp.get("type") != "auth_ok":
@@ -289,6 +291,18 @@ class HubClient:
                         elif mtype == "revocation" and on_revocation:
                             on_revocation(msg.get("token", ""))
 
+                        elif mtype == "webrtc_offer" and on_webrtc_offer:
+                            answer = await on_webrtc_offer(
+                                msg["sdp"], msg["peer_id"],
+                                msg.get("ice_candidates", []))
+                            if answer:
+                                await ws.send(json.dumps({
+                                    "type": "webrtc_answer",
+                                    "peer_id": msg["peer_id"],
+                                    "sdp": answer[0],
+                                    "ice_candidates": answer[1],
+                                }))
+
                         elif mtype == "pong":
                             pass