feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 89 insertions, 0 deletions

diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh
new file mode 100755
index 0000000..d8a5af4
--- /dev/null
+++ b/packaging/build/build-node.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+# Build the meshbay-node package: node-specific files on top of meshbay-common.
+#
+# Expects build-common.sh to have run first (shared venv exists in staging).
+#
+# Usage: ./build-node.sh [staging-dir]
+set -euo pipefail
+
+REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+STAGING="${1:-/tmp/meshbay-build}"
+COMMON_ROOT="$STAGING/meshbay-common-root"
+ROOT="$STAGING/meshbay-node-root"
+
+VENV="$COMMON_ROOT/opt/meshbay-common/venv"
+PYVER=$(basename "$VENV"/lib/python3.*)
+SITE="$VENV/lib/$PYVER/site-packages"
+
+VERSION=$(python3 -c "
+import tomllib, pathlib
+p = pathlib.Path('$REPO/packages/meshbay-node/pyproject.toml')
+print(tomllib.loads(p.read_text())['project']['version'])
+")
+echo "==> meshbay-node $VERSION"
+
+[ -d "$VENV" ] || { echo "!! shared venv not found — run build-common.sh first" >&2; exit 1; }
+
+rm -rf "$ROOT"
+mkdir -p "$ROOT"
+
+# --- Node code in the shared venv (owned by meshbay-node package) ---------
+# MOVE (not copy) from the common staging tree — same rationale as build-hub.sh.
+NODE_ROOT="$ROOT/opt/meshbay-common/venv/lib/$PYVER/site-packages"
+mkdir -p "$NODE_ROOT"
+mv "$SITE/meshbay_node" "$NODE_ROOT/"
+mv "$SITE"/meshbay_node-*.dist-info "$NODE_ROOT/"
+
+# Entry point
+mkdir -p "$ROOT/opt/meshbay-common/venv/bin"
+mv "$VENV/bin/meshbay-node" "$ROOT/opt/meshbay-common/venv/bin/"
+
+# Symlink in PATH
+mkdir -p "$ROOT/usr/bin"
+ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node"
+
+# --- Node-specific assets -------------------------------------------------
+mkdir -p "$ROOT/opt/meshbay-node/share"
+
+# Default env with TMDB token (read at build time).
+# Override with MESHBAY_TMDB_TOKEN_FILE; falls back to QE/node.env (gitignored).
+TMDB_TOKEN_FILE="${MESHBAY_TMDB_TOKEN_FILE:-$REPO/QE/node.env}"
+TMDB_TOKEN=""
+if [ -f "$TMDB_TOKEN_FILE" ]; then
+    TMDB_TOKEN=$(grep -oP 'MESHBAY_TMDB_DEFAULT_TOKEN=\K.*' "$TMDB_TOKEN_FILE" || true)
+fi
+if [ -n "$TMDB_TOKEN" ]; then
+    cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF
+# Default environment for meshbay-node.
+# Copied to ~/.config/meshbay/node.env by 'meshbay-node init' if it does not exist.
+# The operator may override any value there or in the systemd EnvironmentFile.
+
+# TMDB API token for the Videos app (read-only, shared across installations)
+MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN
+EOF
+    echo "    TMDB token baked into default.env"
+else
+    echo "    !! TMDB token not found in QE/node.env — default.env will be empty" >&2
+    touch "$ROOT/opt/meshbay-node/share/default.env"
+fi
+
+# --- Systemd units --------------------------------------------------------
+mkdir -p "$ROOT/usr/lib/systemd/system"
+mkdir -p "$ROOT/usr/lib/systemd/user"
+cp "$REPO/packaging/systemd/meshbay-node.service" \
+   "$ROOT/usr/lib/systemd/system/meshbay-node@.service"
+cp "$REPO/packaging/systemd/meshbay-node-user.service" \
+   "$ROOT/usr/lib/systemd/user/meshbay-node.service"
+
+# --- Firewall profiles ----------------------------------------------------
+# firewalld (Fedora)
+mkdir -p "$ROOT/usr/lib/firewalld/services"
+cp "$REPO/packaging/firewall/firewalld/meshbay-node.xml" \
+   "$ROOT/usr/lib/firewalld/services/"
+
+# UFW (Ubuntu/Debian)
+mkdir -p "$ROOT/etc/ufw/applications.d"
+cp "$REPO/packaging/firewall/ufw/meshbay" \
+   "$ROOT/etc/ufw/applications.d/"
+
+echo "==> meshbay-node staging ready at $ROOT"