feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 3 insertions, 2 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/__init__.py b/packages/meshbay-node/src/meshbay_node/transport/__init__.py
index b3144a6..5a1b8d7 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/__init__.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/__init__.py
@@ -6,15 +6,16 @@ from .http_server import create_http_app
 # QUIC transport (MNP v2) — requires aioquic>=1.0
 # Falls back gracefully if not installed; node still works via TCP+TLS and HTTP.
 try:
-    from .quic_server import QuicChunkServer
+    from .quic_server import QuicChunkServer, Denylist
     from .quic_client import QuicChunkClient
     QUIC_AVAILABLE = True
 except ImportError:
     QuicChunkServer = None  # type: ignore[assignment,misc]
     QuicChunkClient = None  # type: ignore[assignment,misc]
+    Denylist = None  # type: ignore[assignment,misc]
     QUIC_AVAILABLE = False
 
 __all__ = [
     "ChunkServer", "ChunkClient", "create_http_app",
-    "QuicChunkServer", "QuicChunkClient", "QUIC_AVAILABLE",
+    "QuicChunkServer", "QuicChunkClient", "Denylist", "QUIC_AVAILABLE",
 ]