feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2 files changed, 12 insertions, 14 deletions

diff --git a/packaging/deb/meshbay-hub/DEBIAN/control b/packaging/deb/meshbay-hub/DEBIAN/control
index 2f3541c..07799a1 100644
--- a/packaging/deb/meshbay-hub/DEBIAN/control
+++ b/packaging/deb/meshbay-hub/DEBIAN/control
@@ -1,19 +1,16 @@
 Package: meshbay-hub
-Version: 0.2.0
+Version: __VERSION__
 Section: net
 Priority: optional
 Architecture: all
 Maintainer: MeshBay Team <team@meshbay.org>
 Homepage: https://meshbay.org
-Depends: python3 (>= 3.12),
-         python3-meshbay-common (= 0.2.0),
-         postgresql,
-         python3-fastapi,
-         python3-uvicorn,
-         adduser
-Recommends: caddy
+Depends: meshbay-common (= __VERSION__), adduser
+Recommends: caddy, postgresql
 Description: MeshBay Hub — identity authority and group registry server
  MeshBay Hub provides user registration, JWT issuance, group management,
- GEK bundle distribution, revocation, and moderation for MeshBay networks.
+ WebRTC signaling, notifications, and moderation for MeshBay networks.
  .
- Runs as a systemd service behind Caddy for HTTPS (auto Let's Encrypt).
+ Installs hub code into the shared venv at /opt/meshbay-common/venv/ and
+ Alembic migrations at /opt/meshbay-hub/migrations/.
+ Runs as a systemd service behind Caddy for HTTPS.
diff --git a/packaging/deb/meshbay-hub/DEBIAN/postinst b/packaging/deb/meshbay-hub/DEBIAN/postinst
index 48921f2..3cf66a9 100644
--- a/packaging/deb/meshbay-hub/DEBIAN/postinst
+++ b/packaging/deb/meshbay-hub/DEBIAN/postinst
@@ -13,15 +13,16 @@ case "$1" in
                     --gecos "MeshBay service account" meshbay
         fi
 
-        # Create data directory
+        # Create data and log directories
         install -d -o meshbay -g meshbay -m 750 /var/lib/meshbay/hub
         install -d -o meshbay -g meshbay -m 750 /var/log/meshbay
 
-        # Enable and start service
+        # Create config directory (files are placed by the admin, not by us)
+        install -d -m 755 /etc/meshbay
+
+        # Reload systemd if available
         if [ -d /run/systemd/system ]; then
             systemctl daemon-reload || true
-            systemctl enable meshbay-hub.service || true
-            systemctl start meshbay-hub.service || true
         fi
         ;;
 esac