feat: unified group management, public groups, and activity-based sidebar

Create Group wizard (Electron-only) consolidates 6 steps across 4 interfaces
into a single multi-step page: group creation on hub, node attachment, root
selection via folder picker, GEK initialization, and auto-pairing — all in one
flow. Browser SPA keeps its current behavior unchanged.

Public group support (Option A — GEK for all groups):
- All groups have GEK regardless of visibility; open-join groups auto-admit
  via TOFU when join_policy is "open"
- Key rotation blocked for public groups (API guard + UI hidden)
- Hub signaling allows WebRTC offers for nodes hosting open-join groups even
  when the caller isn't a member yet
- attach_group writes join_policy to node.toml
- Daemon loads GEK for all groups, not just private ones
- Known-device path in join_request now auto-admits to open-join groups

Node loopback API bridge (Electron IPC):
- node:detect, node:call, node:pairing-code IPC handlers in main process
- Renderer never sees tokens, paths, or keys (session token = physical access)
- platform.js node namespace for UI consumption
- Loopback endpoints: roots CRUD, member-upload toggle, reload

Bug fixes:
- Root change detection: removed premature ctx["roots"] updates from add_root
  and remove_root that prevented indexer retarget on reload
- Duplicate offline message: global fallback now gated on !group
- Signaling membership check: fallback to open-join groups for non-members

Sidebar groups sorted by last_activity_at (most recent first):
- New Group.last_activity_at column with Alembic migration
- POST /v1/groups/{id}/activity endpoint, called on connect and chat send
- Client-side sort + throttled hub updates (1/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 16 insertions, 3 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/hub_client.py b/packages/meshbay-node/src/meshbay_node/hub_client.py
index b345187..92c39db 100644
--- a/packages/meshbay-node/src/meshbay_node/hub_client.py
+++ b/packages/meshbay-node/src/meshbay_node/hub_client.py
@@ -229,12 +229,24 @@ class HubClient:
             except Exception:
                 pass
 
+    async def update_ws_groups(self, group_ids: list[str]) -> None:
+        """Tell the hub about changed group list without dropping the connection."""
+        ws = self._ws
+        if ws:
+            try:
+                await ws.send(json.dumps({
+                    "type": "update_groups",
+                    "group_ids": group_ids,
+                }))
+            except Exception:
+                pass
+
     async def maintain_ws(
         self,
         on_incoming: Any = None,
         on_revocation: Any = None,
         on_webrtc_offer: Any = None,
-        group_ids: list[str] | None = None,
+        group_ids: list[str] | None = None,  # static list or callable returning one
     ) -> None:
         """
         Maintain a persistent WebSocket connection to the hub.
@@ -267,8 +279,9 @@ class HubClient:
                         "token": self._session.access_token,
                         "node_id": self._session.node_id,
                     }
-                    if group_ids:
-                        auth_msg["group_ids"] = group_ids
+                    gids = group_ids() if callable(group_ids) else group_ids
+                    if gids:
+                        auth_msg["group_ids"] = gids
                     await ws.send(json.dumps(auth_msg))
                     # Bounded: a hub that accepts the socket and then says nothing
                     # — which is what it does for a few seconds while restarting —