fix(node): CLI member invite now registers hub membership and enforces code

Two bugs fixed:

1. `meshbay-node member invite <user>` created a local roster invite
   but never told the hub to add the user to group_members, so the
   group was invisible in the SPA. The node now calls
   POST /v1/groups/{id}/members/{username} after creating the invite,
   and the hub endpoint accepts node-scoped tokens (the admin_id
   check is the real authorization guard).

2. The WebRTC handshake let a previously-pinned user reconnect without
   a code even when a new invite was pending (e.g. after leave + re-invite).
   Now any pending invite forces code entry, regardless of existing
   member/pin status.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

3 files changed, 39 insertions, 15 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/hub_client.py b/packages/meshbay-node/src/meshbay_node/hub_client.py
index 1a746bd..1ed1662 100644
--- a/packages/meshbay-node/src/meshbay_node/hub_client.py
+++ b/packages/meshbay-node/src/meshbay_node/hub_client.py
@@ -240,6 +240,21 @@ class HubClient:
         r.raise_for_status()
         return r.json()
 
+    # ── Group membership ───────────────────────────────────────────────────
+
+    async def add_group_member(self, group_id: str, username: str) -> dict:
+        """Register a user as a hub member of a group (admin only)."""
+        if self._session is None:
+            raise RuntimeError("Not logged in")
+        await self.ensure_fresh_token()
+
+        r = await self._http.post(
+            f"/v1/groups/{group_id}/members/{username}",
+            headers=self._session.auth_headers,
+        )
+        r.raise_for_status()
+        return r.json()
+
     # ── Persistent WebSocket (signaling + revocations) ──────────────────────
 
     async def send_ws(self, data: str) -> None:
diff --git a/packages/meshbay-node/src/meshbay_node/ops.py b/packages/meshbay-node/src/meshbay_node/ops.py
index 34a569f..6d53edb 100644
--- a/packages/meshbay-node/src/meshbay_node/ops.py
+++ b/packages/meshbay-node/src/meshbay_node/ops.py
@@ -190,6 +190,14 @@ async def create_invite(state: dict, group_id: str, username: str, *,
         ttl=ttl,
         username=username,
     )
+
+    hub = _hub(state)
+    try:
+        await hub.add_group_member(group_id, username)
+    except Exception:
+        log.warning("Could not register %s as hub member of %s",
+                    username, group_id[:8])
+
     invites = await roster.list_invites()
     expires = next((i["expires_at"] for i in invites
                     if i["user_id"] == user_id
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index 8402633..003cd23 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -1063,22 +1063,19 @@ class WebRTCPeerSession:
                     status="active", approved_by="open-join",
                 )
                 member = await roster.get_member(session_group, user_id)
-            if not member:
-                # A device this node already pinned — for another group, or an
-                # operator pairing — opening an invite-only group it has no row
-                # for. The device-linking `known` fast-path used to drop straight
-                # into `_join_ok`, which answered `not_authorized_for_group` and
-                # left a real invitee with no way to redeem the code they were
-                # sent. Tell them to enter it *only* when one is actually
-                # waiting for them here; a bare hub-invented pin, with nothing
-                # inviting it, still gets the flat refusal H3 relies on.
+
+            # A pending invite means the operator explicitly re-invited this
+            # person — require the code even if they already have a member
+            # row (e.g. they left and were re-invited, or were revoked then
+            # re-invited).  Without this gate a stale roster row lets them
+            # back in without proving they received the new code.
+            pending_invite = any(
+                i["user_id"] == user_id
+                and i["group_id"] in (session_group, "")
+                for i in await roster.list_invites())
+            if pending_invite:
                 if not code:
-                    invited = any(
-                        i["user_id"] == user_id
-                        and i["group_id"] in (session_group, "")
-                        for i in await roster.list_invites())
-                    self._join_refuse(
-                        "code_required" if invited else "not_authorized_for_group")
+                    self._join_refuse("code_required")
                     return
                 invite = await roster.consume_invite(code, user_id)
                 if not invite:
@@ -1095,6 +1092,10 @@ class WebRTCPeerSession:
                     "via=code (device already known)")
                 member = (await roster.get_member(session_group, user_id)
                           or await roster.get_member(invite["group_id"], user_id))
+
+            if not member:
+                self._join_refuse("not_authorized_for_group")
+                return
             await self._join_ok(
                 user_id, pk_x_raw, session_group,
                 role=member["role"] if member else "",