feat: Phase 7 — Node v2 (multi-group, Sender Keys, 0-RTT, chat, denylist)

Implements all 8 milestones (7.0-7.7):

- 7.0: JWT carries `groups` claim; node verifies group membership at
  MNP handshake (QUIC + TCP+TLS). Resolves security review C2.
- 7.1: QUIC 0-RTT session resumption via stored session tickets
  (17-21ms reconnect vs 47ms cold).
- 7.2: Hub→node WebSocket signaling for NAT punch coordination
  (`client_incoming`/`punch_ready`) + jti denylist push. Denylist
  class blocks revoked users/jtis at handshake.
- 7.3: Multi-group daemon — one QUIC port serves N groups with
  per-group GEK, shared_root, and index routing.
- 7.4: HLS streaming via QUIC (STREAM_SEGMENT message type, ffmpeg
  segment extraction).
- 7.5: Sender Keys protocol for group chat (Signal Groups approach).
  Each member has own sending chain key, HKDF chain ratchet, AES-256-GCM
  encryption, Ed25519 signing. Resolves security review C1.
- 7.6: Chat store (SQLite via aiosqlite), CHAT_MESSAGE MNP wire type
  with peer broadcast, web UI with WebSocket push.
- 7.7: Argon2id calibration CLI.

First security review included (first-review.md). 109 tests, demo-v3
validated against meshbay.org production hub.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 21 insertions, 3 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/server.py b/packages/meshbay-node/src/meshbay_node/transport/server.py
index 6a1b05b..76ac13a 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/server.py
@@ -104,6 +104,7 @@ class _ConnectionHandler:
         gek: bytes,
         shared_root: Path,
         index: GroupIndex,
+        groups: dict[str, dict] | None = None,
     ):
         self._reader      = reader
         self._writer      = writer
@@ -112,8 +113,10 @@ class _ConnectionHandler:
         self._gek         = gek
         self._shared_root = shared_root
         self._index       = index
+        self._groups      = groups
         self._peer        = writer.get_extra_info("peername")
         self._user_id: str | None = None
+        self._group_id: str | None = None
 
     async def handle(self) -> None:
         try:
@@ -133,16 +136,28 @@ class _ConnectionHandler:
             raise ValueError(f"Expected handshake, got {msg.get('type')!r}")
 
         token = msg.get("token", "")
+        group_id = msg.get("group_id", "")
         try:
             decoded = jwt.decode(token, self._hub_pk_pem, algorithms=["EdDSA"])
         except Exception as e:
             raise PermissionError(f"Invalid JWT: {e}") from e
 
-        if decoded.get("exp", 0) < int(time.time()):
-            raise PermissionError("JWT expired")
+        if group_id and group_id not in decoded.get("groups", []):
+            raise PermissionError("Not a member of this group")
+
+        if group_id and self._groups and group_id not in self._groups:
+            raise PermissionError("Group not hosted on this node")
 
         self._user_id = decoded["sub"]
-        log.info("[%s] Handshake OK — user=%s", self._peer, self._user_id[:8])
+        self._group_id = group_id
+
+        if group_id and self._groups and group_id in self._groups:
+            ctx = self._groups[group_id]
+            self._gek = ctx["gek"]
+            self._shared_root = ctx["shared_root"]
+            self._index = ctx["index"]
+
+        log.info("[%s] Handshake OK — user=%s group=%s", self._peer, self._user_id[:8], group_id[:8] if group_id else "none")
 
         await _send(self._writer, {
             "type":    MNP.HANDSHAKE_ACK,
@@ -221,6 +236,7 @@ class ChunkServer:
         port: int = 19000,
         cert_path: Path | None = None,
         key_path: Path | None = None,
+        groups: dict[str, dict] | None = None,
     ):
         self._sk_node     = sk_node
         self._hub_pk_pem  = hub_pk_pem
@@ -231,6 +247,7 @@ class ChunkServer:
         self._port        = port
         self._cert_path   = cert_path
         self._key_path    = key_path
+        self._groups      = groups
         self._server: asyncio.Server | None = None
 
     @property
@@ -264,5 +281,6 @@ class ChunkServer:
             reader, writer,
             self._sk_node, self._hub_pk_pem,
             self._gek, self._shared_root, self._index,
+            groups=self._groups,
         )
         await handler.handle()