fix(node)!: remove unauthenticated HTTP file API and TCP transport

Phase 11.5.A — findings C1 and C6 (see second-review.md).

C1: the per-group HTTP file API bound 0.0.0.0 for every configured group,
private ones included, and served two endpoints with no authentication at all:
GET /index (full Mesh Group Index) and GET /file/{id} (raw plaintext file via
FileResponse). Anyone able to reach the port — LAN, forwarded port, permissive
IPv6 — read every private file. This bypassed the entire GEK-proof and node
sovereignty layer. Deleted rather than patched: it duplicated MNP without any
of its controls.

C6: the TCP+TLS chunk server accepted a bare JWT with no GEK proof, leaving a
second non-compliant handshake path. Deleted; QUIC remains and will be brought
to parity with WebRTC by the unified handshake in 11.5.4.

Transport decision recorded in transport/__init__.py: WebRTC/ICE is primary for
browser and native clients (the only NAT traversal validated here — 2 ISPs,
IPv4 STUN + IPv6, 4G CGNAT); QUIC is kept for LAN, port-forwarded and hub-less
group:// access. punch_nat() is a direct-connection helper, not a traversal
stack.

Also removed server_ssl_context()/client_ssl_context() from tls_cert.py (no
remaining callers) and a dead import of the former in quic_server.py.
generate_self_signed_cert() stays: QUIC uses it, and the certificate hash is
the intended channel-binding anchor for 11.5.6, since QUIC has no DTLS
fingerprint to bind the GEK proof to.

BREAKING CHANGE: node.toml keys `port` and `http_port` are gone. Regenerate
config with `meshbay-node init`. Env var MESHBAY_PORT -> MESHBAY_QUIC_PORT.

Tests: 198 passed (209 - 7 test_http_server - 4 test_transport). No other test
changed status. Net -1300 lines.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 15 insertions, 6 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/__init__.py b/packages/meshbay-node/src/meshbay_node/transport/__init__.py
index df9c209..e423e35 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/__init__.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/__init__.py
@@ -1,7 +1,17 @@
-"""MeshBay Node transport layer — TCP+TLS (v1), QUIC (v2), WebRTC (browsers)."""
-from .server import ChunkServer
-from .client import ChunkClient
-from .http_server import create_http_app
+"""
+MeshBay Node transport layer — WebRTC DataChannel (primary), QUIC (direct/LAN).
+
+Transport decision (2026-08-13, second security review):
+  - WebRTC/ICE is the primary path for browser AND native clients. ICE/STUN is the
+    only NAT traversal validated on this project (2 ISPs, IPv4 STUN + IPv6, 4G CGNAT).
+  - QUIC is kept at parity for LAN, port-forwarded and hub-less `group://` access.
+    `punch_nat()` is a direct-connection helper, not a traversal stack.
+  - TCP+TLS (`server.py`/`client.py`) and the node HTTP file API (`http_server.py`)
+    were REMOVED in Phase 11.5. The HTTP API served private group indexes and
+    plaintext files with no authentication on 0.0.0.0 (finding C1); the TCP server
+    accepted a bare JWT with no GEK proof (finding C6). Neither is coming back —
+    every client path must go through the unified MNP handshake.
+"""
 
 # QUIC transport (MNP v2) — requires aioquic>=1.0
 try:
@@ -14,7 +24,7 @@ except ImportError:
     Denylist = None  # type: ignore[assignment,misc]
     QUIC_AVAILABLE = False
 
-# WebRTC transport (browsers) — requires aiortc>=1.9
+# WebRTC transport (browsers + native clients) — requires aiortc>=1.9
 try:
     from .webrtc_server import WebRTCTransport, WebRTCPeerSession
     WEBRTC_AVAILABLE = True
@@ -24,7 +34,6 @@ except ImportError:
     WEBRTC_AVAILABLE = False
 
 __all__ = [
-    "ChunkServer", "ChunkClient", "create_http_app",
     "QuicChunkServer", "QuicChunkClient", "Denylist", "QUIC_AVAILABLE",
     "WebRTCTransport", "WebRTCPeerSession", "WEBRTC_AVAILABLE",
 ]