feat(ui): 11-point UI overhaul — tabs, transfers, settings, uploads

Hub/UI:
- Icon-only group tabs (chat, files, settings) with per-group default tab
- Transfer widget: filename becomes a clickable link to open completed downloads
- Pulse animation on transfer icon (pale→dark green) while active
- Download button feedback in FilePreview (spinner, auto-reset)
- Group mute toggle persists across navigation
- Login page autofocus, chat refocus after send
- Theme toggle closes menu, status badge and duplicate connecting removed
- Create-folder restricted to operators, download-path note removed
- User preferences API (CRUD) with Alembic migration
- Profile: email display/edit via PATCH /v1/users/me
- Settings: "Defaults" section for default tab selector
- All 10 locale files updated

Node:
- upload_dir in node.toml: separate filesystem path for uploads
- Root.direct flag: uploads land at root path, no subdirectory
- CLI --upload-dir flag on `group add`
- Admin UI accepts upload_dir

Client (Electron):
- shell.openPath bridge for opening completed downloads
- platform.js passes open callback from native save

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

6 files changed, 72 insertions, 34 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/config.py b/packages/meshbay-node/src/meshbay_node/config.py
index c0326f0..8372e5c 100644
--- a/packages/meshbay-node/src/meshbay_node/config.py
+++ b/packages/meshbay-node/src/meshbay_node/config.py
@@ -70,6 +70,10 @@ quic_port   = 19010
                                          # and its files stay in the index,
                                          # rather than looking deleted
 
+# upload_dir: a separate directory for uploads. Files land directly in it,
+# not in an "uploads" subdirectory. It appears as its own root in the index.
+# upload_dir = "/home/user/Incoming"
+
 # The single-directory form still works and means the same thing — one root,
 # named after the directory, receiving uploads.
 [[groups]]
@@ -125,6 +129,7 @@ class RootSpec:
     name:   str = ""          # empty → the directory's basename, derived at load
     kind:   str = "generic"   # generic|video|audio|photo — a view hint, unused for now
     upload: bool = False      # exactly one root per group receives uploads
+    direct: bool = False      # uploads land at root path, not in a subdirectory
 
 
 @dataclass
@@ -137,6 +142,7 @@ class GroupConfig:
     # unprefixed shape.
     roots:      list[RootSpec] = field(default_factory=list)
     shared_dir: str = ""      # legacy single-root form, migrated at load
+    upload_dir: str = ""      # separate filesystem path for uploads
     visibility: str = "private"   # public|private — discoverability, not admission
     # Admission. "invite" (default) means a newcomer needs a one-time pairing code
     # before the node wraps the group key for them; "open" means the node pins
@@ -160,6 +166,11 @@ class GroupConfig:
         """
         if not self.roots and self.shared_dir.strip():
             self.roots = [RootSpec(path=self.shared_dir.strip(), upload=True)]
+        if self.upload_dir.strip():
+            for r in self.roots:
+                r.upload = False
+            self.roots.append(RootSpec(
+                path=self.upload_dir.strip(), upload=True, direct=True))
 
 
 @dataclass
@@ -275,6 +286,7 @@ def load_config(path: Path = DEFAULT_CONFIG_PATH) -> Config:
                     # Ignored when roots are given explicitly (warned about in
                     # _read_roots); otherwise __post_init__ migrates it.
                     shared_dir="" if _read_roots(g) else g.get("shared_dir", ""),
+                    upload_dir=g.get("upload_dir", ""),
                     visibility=g.get("visibility", "private"),
                     join_policy=g.get("join_policy", "invite"),
                     quic_port=g.get("quic_port", cfg.node.quic_port),
diff --git a/packages/meshbay-node/src/meshbay_node/daemon.py b/packages/meshbay-node/src/meshbay_node/daemon.py
index 45aca7a..6d4f172 100644
--- a/packages/meshbay-node/src/meshbay_node/daemon.py
+++ b/packages/meshbay-node/src/meshbay_node/daemon.py
@@ -799,6 +799,8 @@ def main() -> None:
                              "denylist clear")
     parser.add_argument("--dir", default=None,
                         help="shared directory, for group add")
+    parser.add_argument("--upload-dir", default=None,
+                        help="separate upload directory, for group add")
     parser.add_argument("--yes", action="store_true",
                         help="skip the confirmation for destructive commands")
     parser.add_argument("--config", type=Path, default=None,
@@ -1147,7 +1149,9 @@ def main() -> None:
                       f"{g.get('peers', 0)} peer(s)")
                 print(f"      {g['id']}")
                 for r in g.get("roots", []):
-                    flags = " (uploads)" if r.get("upload") else ""
+                    flags = ""
+                    if r.get("upload"):
+                        flags = " (uploads, direct)" if r.get("direct") else " (uploads)"
                     live = "" if r.get("available", True) else "  [UNAVAILABLE]"
                     print(f"      root {r['name']}{flags}{live}")
                 if not g.get("has_gek"):
@@ -1156,20 +1160,25 @@ def main() -> None:
             return
 
         if args.subcommand != "add":
-            print("usage: meshbay-node group list|add <name> --dir <path>")
+            print("usage: meshbay-node group list|add <name> --dir <path> [--upload-dir <path>]")
             sys.exit(1)
         if not args.target or not args.dir:
-            print("usage: meshbay-node group add <name> --dir <path>")
+            print("usage: meshbay-node group add <name> --dir <path> [--upload-dir <path>]")
             print()
             print("The group must already exist on the hub and be yours. This")
             print("only tells the node to host it, and picks the directory.")
+            print("--upload-dir sets a separate directory for uploaded files.")
             sys.exit(1)
 
         cfg = load_config(args.config or DEFAULT_CONFIG_PATH)
-        out = _daemon_api(cfg, "/api/groups/attach", method="POST",
-                          body={"name": args.target, "shared_dir": args.dir})
+        body = {"name": args.target, "shared_dir": args.dir}
+        if args.upload_dir:
+            body["upload_dir"] = args.upload_dir
+        out = _daemon_api(cfg, "/api/groups/attach", method="POST", body=body)
         print(f"{out['name']} ({out['group_id'][:8]}) added to {out['config']}")
         print(f"  shared_dir   {out['shared_dir']}")
+        if out.get("upload_dir"):
+            print(f"  upload_dir   {out['upload_dir']}")
         print()
         print("Tell the daemon to re-read its config, then give the group a key:")
         print("  meshbay-node reload")
diff --git a/packages/meshbay-node/src/meshbay_node/ops.py b/packages/meshbay-node/src/meshbay_node/ops.py
index c111581..20345bb 100644
--- a/packages/meshbay-node/src/meshbay_node/ops.py
+++ b/packages/meshbay-node/src/meshbay_node/ops.py
@@ -315,7 +315,8 @@ async def list_groups(state: dict) -> dict:
     return {"groups": out}
 
 
-async def attach_group(state: dict, name: str, shared_dir: str) -> dict:
+async def attach_group(state: dict, name: str, shared_dir: str,
+                       upload_dir: str = "") -> dict:
     """
     Write a new [[groups]] block into node.toml.
 
@@ -360,19 +361,30 @@ async def attach_group(state: dict, name: str, shared_dir: str) -> dict:
     block = (f'\n[[groups]]\n'
              f'id          = "{group["id"]}"\n'
              f'name        = "{group["name"]}"\n'
-             f'visibility  = "{group.get("visibility", "private")}"\n'
-             f'\n  [[groups.roots]]\n'
-             f'  path   = "{path}"\n'
-             f'  upload = true\n')
+             f'visibility  = "{group.get("visibility", "private")}"\n')
+    if upload_dir:
+        upload_path = Path(upload_dir).expanduser()
+        try:
+            upload_path.mkdir(parents=True, exist_ok=True)
+        except OSError as e:
+            raise OpError(f"Cannot create {upload_path}: {e}") from e
+        block += f'upload_dir  = "{upload_path}"\n'
+    block += (f'\n  [[groups.roots]]\n'
+              f'  path   = "{path}"\n')
+    if not upload_dir:
+        block += f'  upload = true\n'
     try:
         with conf_path.open("a") as f:
             f.write(block)
     except OSError as e:
         raise OpError(f"Cannot write {conf_path}: {e}", status=500) from e
 
-    return {"group_id": group["id"], "name": group["name"],
-            "shared_dir": str(path), "config": str(conf_path),
-            "note": "restart the node to pick it up"}
+    result = {"group_id": group["id"], "name": group["name"],
+              "shared_dir": str(path), "config": str(conf_path),
+              "note": "restart the node to pick it up"}
+    if upload_dir:
+        result["upload_dir"] = str(upload_path)
+    return result
 
 
 async def add_root(state: dict, group_id: str, path: str, *,
diff --git a/packages/meshbay-node/src/meshbay_node/roots.py b/packages/meshbay-node/src/meshbay_node/roots.py
index 8f999d7..bc27bf7 100644
--- a/packages/meshbay-node/src/meshbay_node/roots.py
+++ b/packages/meshbay-node/src/meshbay_node/roots.py
@@ -51,6 +51,7 @@ class Root:
     path: Path
     kind: str = "generic"
     upload: bool = False
+    direct: bool = False
     # Runtime, not configuration: set by the indexer when the directory can no
     # longer be read, and cleared when it comes back.
     available: bool = True
@@ -139,7 +140,8 @@ class RootSet:
                 kind = "generic"
 
             root = Root(name=name, path=path, kind=kind,
-                        upload=bool(spec.get("upload", False)))
+                        upload=bool(spec.get("upload", False)),
+                        direct=bool(spec.get("direct", False)))
             _refuse_nesting(root, roots)
             roots.append(root)
             by_folded[root.folded] = root
@@ -277,11 +279,14 @@ class RootSet:
 
     def describe(self) -> list[dict]:
         """Per-root state for the index payload and the admin UI."""
-        return [
-            {"name": r.name, "kind": r.kind, "available": r.available,
-             "upload": r.upload}
-            for r in self.roots
-        ]
+        out = []
+        for r in self.roots:
+            d: dict = {"name": r.name, "kind": r.kind,
+                        "available": r.available, "upload": r.upload}
+            if r.direct:
+                d["direct"] = True
+            out.append(d)
+        return out
 
 
 def entry_abs_path(roots: RootSet, entry) -> Path | None:
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 22e5e15..f182ab2 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -2087,21 +2087,20 @@ class WebRTCPeerSession:
                         "filename": filename})
             return
 
-        # One destination, chosen by the operator and not by the client:
-        # uploads/ inside the group's designated root. C5a is still honoured —
-        # the name passed the allowlist above, and an existing file is never
-        # replaced, which was the real defect (overwriting a file also made the
-        # attacker its recorded uploader, and therefore able to delete it).
-        rel_dir = f"{upload_root.name}/{UPLOAD_DIR_NAME}"
-        target_dir = upload_root.path / UPLOAD_DIR_NAME
-        try:
-            target_dir.mkdir(parents=True, exist_ok=True)
-        except OSError as e:
-            log.warning("Cannot create upload folder in root %r: %s",
-                        upload_root.name, e)
-            self._send({"type": "error", "detail": "Upload folder unavailable",
-                        "filename": filename})
-            return
+        if upload_root.direct:
+            rel_dir = upload_root.name
+            target_dir = upload_root.path
+        else:
+            rel_dir = f"{upload_root.name}/{UPLOAD_DIR_NAME}"
+            target_dir = upload_root.path / UPLOAD_DIR_NAME
+            try:
+                target_dir.mkdir(parents=True, exist_ok=True)
+            except OSError as e:
+                log.warning("Cannot create upload folder in root %r: %s",
+                            upload_root.name, e)
+                self._send({"type": "error", "detail": "Upload folder unavailable",
+                            "filename": filename})
+                return
 
         upload_key = f"{rel_dir}/{filename}"
         state = self._uploads.get(upload_key)
diff --git a/packages/meshbay-node/src/meshbay_node/ui/app.py b/packages/meshbay-node/src/meshbay_node/ui/app.py
index 050829e..74a7c8a 100644
--- a/packages/meshbay-node/src/meshbay_node/ui/app.py
+++ b/packages/meshbay-node/src/meshbay_node/ui/app.py
@@ -136,6 +136,7 @@ def create_ui_app(state: dict) -> FastAPI:
             state,
             (payload.get("name") or "").strip(),
             (payload.get("shared_dir") or "").strip(),
+            upload_dir=(payload.get("upload_dir") or "").strip(),
         ))
 
     @app.delete("/api/groups/{group_id}/files/{file_id}")