feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 40 insertions, 5 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
index a2220ff..83b729e 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
@@ -100,18 +100,22 @@ class QuicChunkClient:
         jwt_token: str,
         gek: bytes,
         pk_node_b64: str,
-        local_port: int = 0,   # 0 = OS choisit; spécifier pour hole punching Port-Restricted
+        local_port: int = 0,   # 0 = OS picks; set for hole punching (Port-Restricted)
+        group_id: str = "",
+        session_ticket: object | None = None,
     ):
         self._host       = host
         self._port       = port
         self._jwt_token  = jwt_token
         self._gek        = gek
         self._local_port = local_port
+        self._group_id   = group_id
         self._pk_node    = Ed25519PublicKey.from_public_bytes(
             base64.b64decode(pk_node_b64))
         self._proto: _MNPClientProtocol | None = None
         self._cm         = None
         self._ctrl_stream = 0
+        self._session_ticket = session_ticket
 
     async def __aenter__(self):
         await self.connect()
@@ -120,6 +124,13 @@ class QuicChunkClient:
     async def __aexit__(self, *_):
         await self.close()
 
+    @property
+    def session_ticket(self) -> object | None:
+        return self._session_ticket
+
+    def _save_ticket(self, ticket: object) -> None:
+        self._session_ticket = ticket
+
     async def connect(self) -> None:
         import ssl
         config = QuicConfiguration(
@@ -127,20 +138,25 @@ class QuicChunkClient:
             alpn_protocols=ALPN,
             verify_mode=ssl.CERT_NONE,  # identity verified via Ed25519 at MNP layer
         )
+        if self._session_ticket:
+            config.session_ticket = self._session_ticket
         self._cm = connect(
             self._host, self._port,
             configuration=config,
             create_protocol=_MNPClientProtocol,
-            local_port=self._local_port,  # 0 = aléatoire; local_port=X pour hole punching
+            local_port=self._local_port,
+            session_ticket_handler=self._save_ticket,
         )
         self._proto = await self._cm.__aenter__()
 
-        # MNP handshake on stream 0
-        self._proto._send(self._ctrl_stream, {
+        handshake_msg = {
             "type":  MNP.HANDSHAKE,
             "v":     MNP_VERSION,
             "token": self._jwt_token,
-        })
+        }
+        if self._group_id:
+            handshake_msg["group_id"] = self._group_id
+        self._proto._send(self._ctrl_stream, handshake_msg)
         ack = await self._proto._recv(self._ctrl_stream)
         if ack.get("type") != MNP.HANDSHAKE_ACK:
             raise ConnectionError(f"QUIC handshake rejected: {ack}")
@@ -198,3 +214,22 @@ class QuicChunkClient:
             raise ValueError("Plaintext hash mismatch after decryption")
 
         return plaintext
+
+    async def fetch_stream_segment(
+        self, file_id: str, segment_index: int, segment_duration: int = 4,
+    ) -> bytes:
+        """Fetch one HLS segment (MPEG-TS bytes) over QUIC."""
+        sid = self._new_stream()
+        self._proto._send(sid, {
+            "type": MNP.STREAM_SEGMENT,
+            "v": MNP_VERSION,
+            "file_id": file_id,
+            "segment_index": segment_index,
+            "segment_duration": segment_duration,
+        })
+        msg = await self._proto._recv(sid, timeout=30.0)
+
+        if msg.get("type") == "error":
+            raise LookupError(msg.get("detail", "Unknown error"))
+
+        return base64.b64decode(msg["data_b64"])