docs: update all pointers after keyderive + QE restructure

CLAUDE.md: add QE/ to structure, key modules table, server state reference,
security rule updated (QE/ not keypair files), meshbay.org inventory pointer.

devel-phases.md: add milestones 6.6-6.9 (keyderive, bundle, demo scripts,
QUICKSTART rewrite). 81/81 tests.

docs/meshbay-draft-v3.md §6.1.1: new section documenting 3 key generation
strategies (Argon2id CLI, WebCrypto browser+bundle, keystore file) and the
algorithm mismatch caveat between CLI and web registration paths.

docs/USERGUIDE.md §2 Register+Login: replace "generate and persist before
registering" warning with the two clean strategies (derive_keys_from_password
for CLI, keyderive.js + keypair_bundle for browser). Login response updated
with keypair_bundle field.

hub/models.py + users.py + Alembic migration: keypair_bundle column on User,
stored at registration, returned at login (web clients only).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

1 files changed, 83 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py
new file mode 100644
index 0000000..779efdc
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/2041a4060b3c_add_keypair_bundle_federated_groups_.py
@@ -0,0 +1,83 @@
+"""add_keypair_bundle_federated_groups_swarm_sources
+
+Revision ID: 2041a4060b3c
+Revises: d28b9caf9f07
+Create Date: 2026-08-09 14:54:20.883227
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '2041a4060b3c'
+down_revision: Union[str, Sequence[str], None] = 'd28b9caf9f07'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.create_table('content_blocklist',
+    sa.Column('content_hash', sa.String(length=64), nullable=False),
+    sa.Column('reason', sa.String(length=64), nullable=False),
+    sa.Column('added_at', sa.DateTime(timezone=True), nullable=False),
+    sa.Column('added_by', sa.String(length=64), nullable=True),
+    sa.PrimaryKeyConstraint('content_hash')
+    )
+    op.create_table('federated_groups',
+    sa.Column('id', sa.String(length=36), nullable=False),
+    sa.Column('name', sa.String(length=128), nullable=False),
+    sa.Column('source_hub', sa.String(length=128), nullable=False),
+    sa.Column('join_policy', sa.String(length=16), nullable=False),
+    sa.Column('received_at', sa.DateTime(timezone=True), nullable=False),
+    sa.Column('updated_at', sa.DateTime(timezone=True), nullable=False),
+    sa.PrimaryKeyConstraint('id')
+    )
+    op.create_index('ix_federated_groups_name', 'federated_groups', ['name'], unique=False)
+    op.create_index('ix_federated_groups_source', 'federated_groups', ['source_hub'], unique=False)
+    op.create_table('swarm_sources',
+    sa.Column('content_hash', sa.String(length=64), nullable=False),
+    sa.Column('node_id', sa.String(length=36), nullable=False),
+    sa.Column('endpoint', sa.String(length=128), nullable=False),
+    sa.Column('registered_at', sa.DateTime(timezone=True), nullable=False),
+    sa.Column('last_seen', sa.DateTime(timezone=True), nullable=False),
+    sa.PrimaryKeyConstraint('content_hash', 'node_id')
+    )
+    op.create_index('ix_swarm_hash', 'swarm_sources', ['content_hash'], unique=False)
+    op.create_table('content_reports',
+    sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+    sa.Column('reporter_id', sa.String(length=36), nullable=True),
+    sa.Column('content_hash', sa.String(length=64), nullable=False),
+    sa.Column('group_id', sa.String(length=36), nullable=True),
+    sa.Column('reason', sa.String(length=32), nullable=False),
+    sa.Column('detail', sa.String(length=256), nullable=True),
+    sa.Column('ip_address', sa.String(length=45), nullable=False),
+    sa.Column('reported_at', sa.DateTime(timezone=True), nullable=False),
+    sa.ForeignKeyConstraint(['group_id'], ['groups.id'], ),
+    sa.ForeignKeyConstraint(['reporter_id'], ['users.id'], ),
+    sa.PrimaryKeyConstraint('id')
+    )
+    op.create_index('ix_content_reports_group', 'content_reports', ['group_id'], unique=False)
+    op.create_index('ix_content_reports_hash', 'content_reports', ['content_hash'], unique=False)
+    op.add_column('users', sa.Column('keypair_bundle', sa.Text(), nullable=True))
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column('users', 'keypair_bundle')
+    op.drop_index('ix_content_reports_hash', table_name='content_reports')
+    op.drop_index('ix_content_reports_group', table_name='content_reports')
+    op.drop_table('content_reports')
+    op.drop_index('ix_swarm_hash', table_name='swarm_sources')
+    op.drop_table('swarm_sources')
+    op.drop_index('ix_federated_groups_source', table_name='federated_groups')
+    op.drop_index('ix_federated_groups_name', table_name='federated_groups')
+    op.drop_table('federated_groups')
+    op.drop_table('content_blocklist')
+    # ### end Alembic commands ###