feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 75 insertions, 0 deletions

diff --git a/packaging/build/build-common.sh b/packaging/build/build-common.sh
new file mode 100755
index 0000000..3045689
--- /dev/null
+++ b/packaging/build/build-common.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Build the meshbay-common package: shared venv with ALL Python dependencies.
+#
+# Usage: ./build-common.sh [staging-dir]
+#   staging-dir defaults to /tmp/meshbay-build
+#
+# Output: $STAGING/meshbay-common-root/  (ready for dpkg-deb or rpmbuild)
+set -euo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+STAGING="${1:-/tmp/meshbay-build}"
+ROOT="$STAGING/meshbay-common-root"
+VENV_FINAL="/opt/meshbay-common/venv"
+VENV_BUILD="$ROOT$VENV_FINAL"
+WHEEL_DIR="$STAGING/wheels"
+
+VERSION=$(python3 -c "
+import tomllib, pathlib
+p = pathlib.Path('$REPO/packages/meshbay-common/pyproject.toml')
+print(tomllib.loads(p.read_text())['project']['version'])
+")
+echo "==> meshbay-common $VERSION"
+
+rm -rf "$ROOT"
+mkdir -p "$ROOT/opt/meshbay-common" "$WHEEL_DIR"
+
+# --- Create venv -----------------------------------------------------------
+echo "    creating venv at $VENV_BUILD"
+python3 -m venv "$VENV_BUILD"
+"$VENV_BUILD/bin/pip" install --upgrade pip wheel 2>&1 | tail -1
+
+# --- Build wheels for all three packages -----------------------------------
+echo "    building wheels"
+for pkg in meshbay-common meshbay-hub meshbay-node; do
+    "$VENV_BUILD/bin/pip" wheel \
+        --no-deps \
+        --wheel-dir "$WHEEL_DIR" \
+        "$REPO/packages/$pkg" 2>&1 | tail -1
+done
+
+# --- Install everything into the venv -------------------------------------
+echo "    installing all packages + dependencies"
+"$VENV_BUILD/bin/pip" install \
+    --find-links "$WHEEL_DIR" \
+    meshbay-common meshbay-hub meshbay-node 2>&1 | tail -3
+
+# --- Strip build tools from the venv (not needed at runtime) ---------------
+echo "    stripping build tools"
+"$VENV_BUILD/bin/pip" uninstall -y pip setuptools wheel 2>&1 | tail -1
+rm -rf "$VENV_BUILD/lib"/python*/site-packages/pip*
+rm -rf "$VENV_BUILD/lib"/python*/site-packages/setuptools*
+rm -rf "$VENV_BUILD/lib"/python*/site-packages/wheel*
+rm -f "$VENV_BUILD/bin/pip"*
+
+# --- Fix shebangs and pyvenv.cfg ------------------------------------------
+# The venv was built under $ROOT but will be installed at /opt/meshbay-common/venv/
+echo "    fixing paths ($ROOT -> '')"
+for f in "$VENV_BUILD/bin"/*; do
+    [ -f "$f" ] || continue
+    [ -L "$f" ] && continue
+    head -1 "$f" | grep -q "^#!" || continue
+    sed -i "1s|$ROOT||" "$f"
+done
+sed -i "s|$ROOT||g" "$VENV_BUILD/pyvenv.cfg"
+
+# --- Remove __pycache__ (will be regenerated on first import) --------------
+find "$VENV_BUILD" -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
+
+# --- Keep a copy of the wheels for reference -------------------------------
+mkdir -p "$ROOT/opt/meshbay-common/wheels"
+cp "$WHEEL_DIR"/meshbay_common-*.whl "$ROOT/opt/meshbay-common/wheels/"
+
+echo "==> meshbay-common staging ready at $ROOT"
+echo "    venv: $VENV_BUILD"
+echo "    version: $VERSION"