fix(node): CLI member invite now registers hub membership and enforces code

Two bugs fixed:

1. `meshbay-node member invite <user>` created a local roster invite
   but never told the hub to add the user to group_members, so the
   group was invisible in the SPA. The node now calls
   POST /v1/groups/{id}/members/{username} after creating the invite,
   and the hub endpoint accepts node-scoped tokens (the admin_id
   check is the real authorization guard).

2. The WebRTC handshake let a previously-pinned user reconnect without
   a code even when a new invite was pending (e.g. after leave + re-invite).
   Now any pending invite forces code entry, regardless of existing
   member/pin status.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 16 insertions, 15 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 8402633..003cd23 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -1063,22 +1063,19 @@ class WebRTCPeerSession:
                     status="active", approved_by="open-join",
                 )
                 member = await roster.get_member(session_group, user_id)
-            if not member:
-                # A device this node already pinned — for another group, or an
-                # operator pairing — opening an invite-only group it has no row
-                # for. The device-linking `known` fast-path used to drop straight
-                # into `_join_ok`, which answered `not_authorized_for_group` and
-                # left a real invitee with no way to redeem the code they were
-                # sent. Tell them to enter it *only* when one is actually
-                # waiting for them here; a bare hub-invented pin, with nothing
-                # inviting it, still gets the flat refusal H3 relies on.
+
+            # A pending invite means the operator explicitly re-invited this
+            # person — require the code even if they already have a member
+            # row (e.g. they left and were re-invited, or were revoked then
+            # re-invited).  Without this gate a stale roster row lets them
+            # back in without proving they received the new code.
+            pending_invite = any(
+                i["user_id"] == user_id
+                and i["group_id"] in (session_group, "")
+                for i in await roster.list_invites())
+            if pending_invite:
                 if not code:
-                    invited = any(
-                        i["user_id"] == user_id
-                        and i["group_id"] in (session_group, "")
-                        for i in await roster.list_invites())
-                    self._join_refuse(
-                        "code_required" if invited else "not_authorized_for_group")
+                    self._join_refuse("code_required")
                     return
                 invite = await roster.consume_invite(code, user_id)
                 if not invite:
@@ -1095,6 +1092,10 @@ class WebRTCPeerSession:
                     "via=code (device already known)")
                 member = (await roster.get_member(session_group, user_id)
                           or await roster.get_member(invite["group_id"], user_id))
+
+            if not member:
+                self._join_refuse("not_authorized_for_group")
+                return
             await self._join_ok(
                 user_id, pk_x_raw, session_group,
                 role=member["role"] if member else "",