feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2 files changed, 39 insertions, 0 deletions

diff --git a/packaging/deb/meshbay-client/DEBIAN/control b/packaging/deb/meshbay-client/DEBIAN/control
new file mode 100644
index 0000000..e6a49b9
--- /dev/null
+++ b/packaging/deb/meshbay-client/DEBIAN/control
@@ -0,0 +1,17 @@
+Package: meshbay-client
+Version: __VERSION__
+Section: net
+Priority: optional
+Architecture: __ARCH__
+Maintainer: MeshBay Team <team@meshbay.org>
+Homepage: https://meshbay.org
+Depends: libgtk-3-0, libnotify4, libnss3, libxss1, libxtst6,
+         libatspi2.0-0, libdrm2, libgbm1, libasound2
+Recommends: meshbay-node
+Description: MeshBay — peer-to-peer file sharing, streaming and group chat
+ Desktop client for MeshBay. Connects to MeshBay nodes over WebRTC for
+ file sharing, video streaming, and group chat. Includes Chromecast and
+ Smart TV casting support.
+ .
+ Installs the Electron application to /opt/meshbay-client/ and a Gnome
+ launcher named "MeshBay".
diff --git a/packaging/deb/meshbay-client/DEBIAN/postinst b/packaging/deb/meshbay-client/DEBIAN/postinst
new file mode 100644
index 0000000..f262665
--- /dev/null
+++ b/packaging/deb/meshbay-client/DEBIAN/postinst
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure)
+        # chrome-sandbox requires SUID root for Chromium's namespace sandbox
+        if [ -f /opt/meshbay-client/chrome-sandbox ]; then
+            chown root:root /opt/meshbay-client/chrome-sandbox
+            chmod 4755 /opt/meshbay-client/chrome-sandbox
+        fi
+
+        # Update desktop database and icon cache
+        if command -v update-desktop-database >/dev/null 2>&1; then
+            update-desktop-database /usr/share/applications || true
+        fi
+        if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+            gtk-update-icon-cache -f -t /usr/share/icons/hicolor || true
+        fi
+        ;;
+esac
+
+#DEBHELPER#