feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 55 insertions, 47 deletions

diff --git a/packaging/README.md b/packaging/README.md
index 13b8fbf..a7f2d84 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -1,72 +1,67 @@
 # MeshBay — Packaging
 
-Three distributable packages:
+Four packages, installed under `/opt/<PACKAGE_NAME>/`:
 
 | Package | RPM spec | DEB control | Description |
 |---|---|---|---|
-| `python3-meshbay-common` | `rpm/python3-meshbay-common.spec` | `deb/python3-meshbay-common/` | Shared crypto + protocol lib |
+| `meshbay-common` | `rpm/meshbay-common.spec` | `deb/meshbay-common/` | Shared Python venv + all pip deps |
 | `meshbay-hub` | `rpm/meshbay-hub.spec` | `deb/meshbay-hub/` | Hub server (FastAPI + PostgreSQL) |
 | `meshbay-node` | `rpm/meshbay-node.spec` | `deb/meshbay-node/` | Node daemon + local UI |
+| `meshbay-client` | `rpm/meshbay-client.spec` | `deb/meshbay-client/` | Electron desktop app |
 
-## Building RPMs (Fedora/RHEL)
+## Building packages
 
 ```bash
-# Install build tools
-sudo dnf install -y rpm-build python3-pip
+# On Ubuntu 26.04:
+bash packaging/build/build-packages.sh deb
 
-# Build all three packages
-for pkg in python3-meshbay-common meshbay-hub meshbay-node; do
-    rpmbuild -ba packaging/rpm/${pkg}.spec
-done
+# On Fedora 44 (local):
+bash packaging/build/build-packages.sh rpm
+
+# On Raspberry Pi (arm64, deferred):
+bash packaging/build/build-packages.sh deb --arm64
 ```
 
-## Building DEBs (Debian/Ubuntu)
+Output: `meshbay-{common,hub,node,client}_0.8.0_{arch}.{deb,rpm}` in `/tmp/meshbay-build/out/`.
 
-```bash
-# Install build tools
-sudo apt install -y dpkg-dev debhelper python3-pip
+## Install order
 
-# Build common library first (dependency)
-dpkg-deb --build packaging/deb/python3-meshbay-common
-dpkg-deb --build packaging/deb/meshbay-hub
-dpkg-deb --build packaging/deb/meshbay-node
+Always install `meshbay-common` first (owns the shared Python venv).
+
+```bash
+# Ubuntu/Debian
+sudo dpkg -i meshbay-common_*.deb
+sudo dpkg -i meshbay-hub_*.deb meshbay-node_*.deb
+sudo dpkg -i meshbay-client_*.deb
 
-# Install
-sudo dpkg -i python3-meshbay-common_0.2.0_all.deb
-sudo dpkg -i meshbay-hub_0.2.0_all.deb
-sudo dpkg -i meshbay-node_0.2.0_all.deb
+# Fedora
+sudo rpm -ivh meshbay-common-*.rpm
+sudo rpm -ivh meshbay-hub-*.rpm meshbay-node-*.rpm
+sudo rpm -ivh meshbay-client-*.rpm
 ```
 
-## Install order
+## Architecture
+
+meshbay-common owns the shared Python virtual environment at
+`/opt/meshbay-common/venv/`. Hub and node install their code into that venv.
+The client is a standalone Electron app at `/opt/meshbay-client/`.
 
-Always install `python3-meshbay-common` first (dependency of both hub and node).
+No pip runs at install time — everything is pre-built.
 
 ## Post-install (hub)
 
 ```bash
-# Generate hub keypair
-sudo -u meshbay meshbay-hub --generate-keys
-
-# Edit config
+meshbay-hub --generate-keys
+sudo cp /opt/meshbay-hub/share/hub.toml.example /etc/meshbay/hub.toml
 sudo nano /etc/meshbay/hub.toml
-
-# Configure Caddy for HTTPS
-sudo nano /etc/caddy/Caddyfile
-
-# Start
 sudo systemctl enable --now meshbay-hub
 ```
 
 ## Post-install (node)
 
 ```bash
-# Initialize node (writes example config)
-meshbay-node init
-
-# Edit config
+meshbay-node init                   # copies default.env (with TMDB token)
 nano ~/.config/meshbay/node.toml
-
-# Start as user service
 systemctl --user enable --now meshbay-node
 ```
 
@@ -74,29 +69,42 @@ systemctl --user enable --now meshbay-node
 
 The Electron client runs an HTTP relay on **TCP 19550-19553** to stream
 decrypted video to Chromecast / Smart TV devices on the local network.
-Chromecast discovery uses **mDNS (UDP 5353)**.  These ports must be open on the
-machine running the client.
+Chromecast discovery uses **mDNS (UDP 5353)**.
 
 ### Fedora / RHEL (firewalld)
 
+Pre-installed service files at `/usr/lib/firewalld/services/`:
+
 ```bash
-sudo firewall-cmd --permanent --add-service=mdns
-sudo firewall-cmd --permanent --add-port=19550-19553/tcp
+sudo firewall-cmd --permanent --add-service=meshbay-cast
 sudo firewall-cmd --reload
 ```
 
 ### Ubuntu / Debian (ufw)
 
+Pre-installed application profile at `/etc/ufw/applications.d/meshbay`:
+
 ```bash
-sudo ufw allow 5353/udp comment "mDNS - Chromecast discovery"
-sudo ufw allow 19550:19553/tcp comment "meshbay cast relay"
+sudo ufw allow "MeshBay Cast"
 ```
 
-## Systemd service files
+## Systemd units
 
 | File | Location |
 |---|---|
 | `systemd/meshbay-hub.service` | `/usr/lib/systemd/system/meshbay-hub.service` |
-| `systemd/meshbay-node.service` | `/usr/lib/systemd/user/meshbay-node.service` |
+| `systemd/meshbay-node@.service` | `/usr/lib/systemd/system/meshbay-node@.service` |
+| `systemd/meshbay-node.service` (user) | `/usr/lib/systemd/user/meshbay-node.service` |
+
+The node user service is enabled by the person themselves:
+
+```bash
+systemctl --user enable --now meshbay-node
+loginctl enable-linger $USER    # keep serving when logged out
+```
+
+## Desktop launcher
 
-The node service is a **user service** (runs as the user's own account, with access to their home directory). The hub is a **system service** (runs as the `meshbay` system account).
+The client installs a Gnome `.desktop` file at
+`/usr/share/applications/meshbay.desktop` — the application appears as
+**"MeshBay"** in the applications menu.