feat(node): full Node admin panel — CLI parity, hot-reload, group lifecycle

Node admin panel (NodePage) now covers every CLI operation over MNP:
group attach/detach, roster, member unpin, GEK rotate, denylist, reload.

Daemon hot-loads new groups and tears down removed ones on config reload
instead of requiring a full restart. Group attach/detach via MNP or
local API triggers an automatic reload so the group is live immediately.

Fixed GroupPage hang on first visit to a newly created group: the JWT
issued at login didn't include the new group, the node rejected with
not_a_member, and the token-refresh path returned without re-triggering
the connect effect (Boolean(token) didn't change). Now bumps retryKey
after a successful refresh so the effect re-runs with the fresh token.

NodePage marks groups hosted by the node but absent from the hub with a
"not on hub" badge so stale groups are visible and easy to remove.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 17 insertions, 1 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/ui/app.py b/packages/meshbay-node/src/meshbay_node/ui/app.py
index 74a7c8a..a068a8d 100644
--- a/packages/meshbay-node/src/meshbay_node/ui/app.py
+++ b/packages/meshbay-node/src/meshbay_node/ui/app.py
@@ -12,6 +12,7 @@ Served only on 127.0.0.1 — not exposed to the network.
 Gated by a per-run session token (11.5.3) — printed at daemon startup.
 """
 
+import asyncio
 import base64
 import json
 import logging
@@ -132,12 +133,27 @@ def create_ui_app(state: dict) -> FastAPI:
         return await _op(lambda: ops.list_groups(state))
     @app.post("/api/groups/attach")
     async def attach_group(payload: dict):
-        return await _op(lambda: ops.attach_group(
+        result = await _op(lambda: ops.attach_group(
             state,
             (payload.get("name") or "").strip(),
             (payload.get("shared_dir") or "").strip(),
             upload_dir=(payload.get("upload_dir") or "").strip(),
         ))
+        reload_fn = state.get("reload_fn")
+        if reload_fn:
+            asyncio.ensure_future(reload_fn())
+        return result
+
+    @app.post("/api/groups/detach")
+    async def detach_group(payload: dict):
+        result = await _op(lambda: ops.detach_group(
+            state,
+            (payload.get("name") or payload.get("group_id") or "").strip(),
+        ))
+        reload_fn = state.get("reload_fn")
+        if reload_fn:
+            asyncio.ensure_future(reload_fn())
+        return result
 
     @app.delete("/api/groups/{group_id}/files/{file_id}")
     async def delete_file(group_id: str, file_id: str):