feat(hub): split the group UI into a pluggable "applications" architecture

GroupPage's 6620-line app.js carried Chat and Files wedged in directly, with
no way to add another group-level app without touching the shell itself. It
is now app.js (routing, non-group pages) plus nine focused files — apps.js
(the registry), chat-app.js, files-app.js, video-player.js, group-page.js
(the shell), group-settings.js, hub-client.js, icon.js and file-utils.js —
with docs/apps.md as the checklist for adding one (Videos/Music/Photos are
sketched there, not built).

Node side gained the matching enablement mechanism, mirroring
member_upload exactly: a roster setting, a signed apps_enabled op enforced
by _has_admin_authority, exposed in the handshake ack. Operators toggle
applications per group from Settings, which also gained a small reorder:
Invite, Pairing, Applications, Shared directories, Uploads, danger zone,
Your devices, Members.

Two bugs surfaced during the split, both missing an import across the new
file boundary and invisible to node --check or a module-load probe since
they only throw when the code path actually runs:

- group-page.js called onRefreshAuth on a stale-token handshake rejection,
  but app.js never imported refreshAccessToken from hub-client.js — so a
  brand new member (including a group's own creator) hit "Not a member of
  this group" and the retry silently failed, throwing before it could
  refresh the token.
- chat-app.js called getLocale() for message timestamps without importing
  it from i18n.js. Opening Chat on a group with real messages threw mid-
  render; uncaught, that appears to wedge Preact's render scheduler, so
  every button on the page stopped responding until reload.

Caught the second class of bug with a proper no-undef audit across all
split files (a temporarily installed ESLint 9, since the system one is too
old to parse this codebase's syntax) rather than trusting grep. 827 tests
pass; 6 new ones cover the apps_enabled policy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016SF6RKNBKg9qejmoMJ9ybA

1 files changed, 22 insertions, 0 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/roster.py b/packages/meshbay-node/src/meshbay_node/roster.py
index 9a52b53..1cc8cae 100644
--- a/packages/meshbay-node/src/meshbay_node/roster.py
+++ b/packages/meshbay-node/src/meshbay_node/roster.py
@@ -22,6 +22,7 @@ The code is what binds a public key to an account without asking the hub
 from __future__ import annotations
 
 import hashlib
+import json
 import logging
 import os
 import secrets
@@ -577,6 +578,27 @@ class Roster:
                                "1" if allowed else "0", set_by)
         return allowed
 
+    # Which group "applications" (Chat, Files, and whatever registers later in
+    # apps.js) are shown to members. Unset means every app that exists — an
+    # existing group's tabs must not disappear because a node was upgraded.
+    SETTING_ENABLED_APPS = "enabled_apps"
+    DEFAULT_APPS = ("chat", "files")
+
+    async def enabled_apps(self, group_id: str) -> list[str]:
+        value = await self.get_setting(group_id, self.SETTING_ENABLED_APPS)
+        if value is None:
+            return list(self.DEFAULT_APPS)
+        try:
+            return list(json.loads(value))
+        except (ValueError, TypeError):
+            return list(self.DEFAULT_APPS)
+
+    async def set_enabled_apps(self, group_id: str, apps: list[str],
+                               set_by: str = "") -> list[str]:
+        await self.set_setting(group_id, self.SETTING_ENABLED_APPS,
+                               json.dumps(sorted(apps)), set_by)
+        return apps
+
     async def create_invite(
         self,
         group_id: str,