feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 7 insertions, 3 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/client.py b/packages/meshbay-node/src/meshbay_node/transport/client.py
index 3430365..63d50af 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/client.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/client.py
@@ -58,11 +58,13 @@ class ChunkClient:
         jwt_token: str,
         gek: bytes,
         pk_node_b64: str,     # node's Ed25519 PK from hub — used for sig verification
+        group_id: str = "",
     ):
         self._host       = host
         self._port       = port
         self._jwt_token  = jwt_token
         self._gek        = gek
+        self._group_id   = group_id
         self._pk_node    = Ed25519PublicKey.from_public_bytes(
             base64.b64decode(pk_node_b64))
         self._reader: asyncio.StreamReader | None = None
@@ -80,12 +82,14 @@ class ChunkClient:
         self._reader, self._writer = await asyncio.open_connection(
             self._host, self._port, ssl=ssl_ctx)
 
-        # MNP handshake
-        await _send(self._writer, {
+        handshake_msg = {
             "type":  MNP.HANDSHAKE,
             "v":     MNP_VERSION,
             "token": self._jwt_token,
-        })
+        }
+        if self._group_id:
+            handshake_msg["group_id"] = self._group_id
+        await _send(self._writer, handshake_msg)
         ack = await _recv(self._reader)
         if ack.get("type") != MNP.HANDSHAKE_ACK:
             raise ConnectionError(f"Handshake rejected: {ack}")