fix(node)!: remove unauthenticated HTTP file API and TCP transport

Phase 11.5.A — findings C1 and C6 (see second-review.md).

C1: the per-group HTTP file API bound 0.0.0.0 for every configured group,
private ones included, and served two endpoints with no authentication at all:
GET /index (full Mesh Group Index) and GET /file/{id} (raw plaintext file via
FileResponse). Anyone able to reach the port — LAN, forwarded port, permissive
IPv6 — read every private file. This bypassed the entire GEK-proof and node
sovereignty layer. Deleted rather than patched: it duplicated MNP without any
of its controls.

C6: the TCP+TLS chunk server accepted a bare JWT with no GEK proof, leaving a
second non-compliant handshake path. Deleted; QUIC remains and will be brought
to parity with WebRTC by the unified handshake in 11.5.4.

Transport decision recorded in transport/__init__.py: WebRTC/ICE is primary for
browser and native clients (the only NAT traversal validated here — 2 ISPs,
IPv4 STUN + IPv6, 4G CGNAT); QUIC is kept for LAN, port-forwarded and hub-less
group:// access. punch_nat() is a direct-connection helper, not a traversal
stack.

Also removed server_ssl_context()/client_ssl_context() from tls_cert.py (no
remaining callers) and a dead import of the former in quic_server.py.
generate_self_signed_cert() stays: QUIC uses it, and the certificate hash is
the intended channel-binding anchor for 11.5.6, since QUIC has no DTLS
fingerprint to bind the GEK proof to.

BREAKING CHANGE: node.toml keys `port` and `http_port` are gone. Regenerate
config with `meshbay-node init`. Env var MESHBAY_PORT -> MESHBAY_QUIC_PORT.

Tests: 198 passed (209 - 7 test_http_server - 4 test_transport). No other test
changed status. Net -1300 lines.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 3 insertions, 15 deletions

diff --git a/packages/meshbay-node/tests/test_daemon.py b/packages/meshbay-node/tests/test_daemon.py
index 1c5a07e..e899639 100644
--- a/packages/meshbay-node/tests/test_daemon.py
+++ b/packages/meshbay-node/tests/test_daemon.py
@@ -21,7 +21,6 @@ from meshbay_node.config import Config, HubConfig, NodeConfig, GroupConfig, Keys
 from meshbay_node.daemon import NodeDaemon
 from meshbay_node.indexer import DirectoryIndexer
 
-
 def _mock_keystore_keys(sk_ed):
     """Create a mock keystore with real Ed25519 + X25519 key material."""
     sk_x = X25519PrivateKey.generate()
@@ -35,23 +34,19 @@ def _mock_keystore_keys(sk_ed):
     mock_keys.pk_x25519_b64 = base64.b64encode(pk_x_raw).decode()
     return mock_keys
 
-
 @pytest.fixture
 def sk_hub():
     return Ed25519PrivateKey.generate()
 
-
 @pytest.fixture
 def hub_pk_pem(sk_hub):
     return sk_hub.public_key().public_bytes(
         serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo)
 
-
 @pytest.fixture
 def gek():
     return generate_gek()
 
-
 @pytest.fixture
 def shared_dir(tmp_path):
     d = tmp_path / "shared"
@@ -60,26 +55,22 @@ def shared_dir(tmp_path):
     (d / "hello.txt").write_bytes(b"hello daemon test " * 50)
     return d
 
-
 @pytest.fixture
 def node_config(tmp_path, shared_dir):
     return Config(
         hub=HubConfig(url="http://localhost:9999", username="testuser"),
-        node=NodeConfig(port=29000, quic_port=29010, http_port=29001, ui_port=28000),
+        node=NodeConfig(quic_port=29010, ui_port=28000),
         groups=[GroupConfig(
             id="g" * 32,
             name="test-group",
             shared_dir=str(shared_dir),
             visibility="private",
-            port=29000,
             quic_port=29010,
-            http_port=29001,
         )],
         keystore=KeystoreConfig(path=tmp_path / "keystore.enc"),
         data_dir=tmp_path / "data",
     )
 
-
 @pytest.mark.asyncio
 async def test_daemon_creates_chat_store(tmp_path, node_config, gek, hub_pk_pem):
     """Daemon creates ChatStore for each group and shuts down cleanly."""
@@ -146,7 +137,6 @@ async def test_daemon_creates_chat_store(tmp_path, node_config, gek, hub_pk_pem)
         for store in daemon._chat_stores.values():
             assert store._db is None
 
-
 @pytest.mark.asyncio
 async def test_daemon_no_groups_exits(tmp_path):
     """Daemon with no valid groups exits cleanly."""
@@ -188,19 +178,18 @@ async def test_daemon_no_groups_exits(tmp_path):
 
     assert len(daemon._chat_stores) == 0
 
-
 @pytest.mark.asyncio
 async def test_daemon_index_change_pushes_to_peers(tmp_path, shared_dir, gek, hub_pk_pem):
     """Index change callback pushes updated index to WebRTC peers."""
     config = Config(
         hub=HubConfig(url="http://localhost:9999", username="testuser"),
-        node=NodeConfig(port=29000, quic_port=29010, http_port=29001, ui_port=28000),
+        node=NodeConfig(quic_port=29010, ui_port=28000),
         groups=[GroupConfig(
             id="a" * 32,
             name="test-group",
             shared_dir=str(shared_dir),
             visibility="private",
-            port=29000, quic_port=29010, http_port=29001,
+            quic_port=29010,
         )],
         keystore=KeystoreConfig(path=tmp_path / "keystore.enc"),
         data_dir=tmp_path / "data",
@@ -237,7 +226,6 @@ async def test_daemon_index_change_pushes_to_peers(tmp_path, shared_dir, gek, hu
     call_args = daemon._hub.register_swarm.call_args
     assert len(call_args[0][0]) == indexer.index.count
 
-
 @pytest.mark.asyncio
 async def test_daemon_index_change_skips_other_group_peers(
     tmp_path, shared_dir, gek, hub_pk_pem