feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

8 files changed, 102 insertions, 23 deletions

diff --git a/packaging/deb/meshbay-client/DEBIAN/control b/packaging/deb/meshbay-client/DEBIAN/control
new file mode 100644
index 0000000..e6a49b9
--- /dev/null
+++ b/packaging/deb/meshbay-client/DEBIAN/control
@@ -0,0 +1,17 @@
+Package: meshbay-client
+Version: __VERSION__
+Section: net
+Priority: optional
+Architecture: __ARCH__
+Maintainer: MeshBay Team <team@meshbay.org>
+Homepage: https://meshbay.org
+Depends: libgtk-3-0, libnotify4, libnss3, libxss1, libxtst6,
+         libatspi2.0-0, libdrm2, libgbm1, libasound2
+Recommends: meshbay-node
+Description: MeshBay — peer-to-peer file sharing, streaming and group chat
+ Desktop client for MeshBay. Connects to MeshBay nodes over WebRTC for
+ file sharing, video streaming, and group chat. Includes Chromecast and
+ Smart TV casting support.
+ .
+ Installs the Electron application to /opt/meshbay-client/ and a Gnome
+ launcher named "MeshBay".
diff --git a/packaging/deb/meshbay-client/DEBIAN/postinst b/packaging/deb/meshbay-client/DEBIAN/postinst
new file mode 100644
index 0000000..f262665
--- /dev/null
+++ b/packaging/deb/meshbay-client/DEBIAN/postinst
@@ -0,0 +1,22 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure)
+        # chrome-sandbox requires SUID root for Chromium's namespace sandbox
+        if [ -f /opt/meshbay-client/chrome-sandbox ]; then
+            chown root:root /opt/meshbay-client/chrome-sandbox
+            chmod 4755 /opt/meshbay-client/chrome-sandbox
+        fi
+
+        # Update desktop database and icon cache
+        if command -v update-desktop-database >/dev/null 2>&1; then
+            update-desktop-database /usr/share/applications || true
+        fi
+        if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+            gtk-update-icon-cache -f -t /usr/share/icons/hicolor || true
+        fi
+        ;;
+esac
+
+#DEBHELPER#
diff --git a/packaging/deb/meshbay-common/DEBIAN/control b/packaging/deb/meshbay-common/DEBIAN/control
new file mode 100644
index 0000000..4089f4b
--- /dev/null
+++ b/packaging/deb/meshbay-common/DEBIAN/control
@@ -0,0 +1,14 @@
+Package: meshbay-common
+Version: __VERSION__
+Section: python
+Priority: optional
+Architecture: __ARCH__
+Maintainer: MeshBay Team <team@meshbay.org>
+Homepage: https://meshbay.org
+Depends: python3 (>= 3.12)
+Description: MeshBay shared Python runtime and libraries
+ Provides the shared Python virtual environment, cryptographic primitives
+ (Ed25519, X25519, GEK wrap/unwrap, ChaCha20-Poly1305), protocol types (MNP,
+ MHP), and all pip dependencies used by meshbay-hub and meshbay-node.
+ .
+ Installs to /opt/meshbay-common/venv/.
diff --git a/packaging/deb/meshbay-common/DEBIAN/postinst b/packaging/deb/meshbay-common/DEBIAN/postinst
new file mode 100644
index 0000000..d675c0c
--- /dev/null
+++ b/packaging/deb/meshbay-common/DEBIAN/postinst
@@ -0,0 +1,15 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure)
+        # Recompile bytecode for the installed Python version.
+        # The venv was built on the build machine; .pyc files may reference
+        # a different path or Python micro-version.
+        if command -v py3compile >/dev/null 2>&1; then
+            py3compile /opt/meshbay-common/venv/lib/ 2>/dev/null || true
+        fi
+        ;;
+esac
+
+#DEBHELPER#
diff --git a/packaging/deb/meshbay-hub/DEBIAN/control b/packaging/deb/meshbay-hub/DEBIAN/control
index 2f3541c..07799a1 100644
--- a/packaging/deb/meshbay-hub/DEBIAN/control
+++ b/packaging/deb/meshbay-hub/DEBIAN/control
@@ -1,19 +1,16 @@
 Package: meshbay-hub
-Version: 0.2.0
+Version: __VERSION__
 Section: net
 Priority: optional
 Architecture: all
 Maintainer: MeshBay Team <team@meshbay.org>
 Homepage: https://meshbay.org
-Depends: python3 (>= 3.12),
-         python3-meshbay-common (= 0.2.0),
-         postgresql,
-         python3-fastapi,
-         python3-uvicorn,
-         adduser
-Recommends: caddy
+Depends: meshbay-common (= __VERSION__), adduser
+Recommends: caddy, postgresql
 Description: MeshBay Hub — identity authority and group registry server
  MeshBay Hub provides user registration, JWT issuance, group management,
- GEK bundle distribution, revocation, and moderation for MeshBay networks.
+ WebRTC signaling, notifications, and moderation for MeshBay networks.
  .
- Runs as a systemd service behind Caddy for HTTPS (auto Let's Encrypt).
+ Installs hub code into the shared venv at /opt/meshbay-common/venv/ and
+ Alembic migrations at /opt/meshbay-hub/migrations/.
+ Runs as a systemd service behind Caddy for HTTPS.
diff --git a/packaging/deb/meshbay-hub/DEBIAN/postinst b/packaging/deb/meshbay-hub/DEBIAN/postinst
index 48921f2..3cf66a9 100644
--- a/packaging/deb/meshbay-hub/DEBIAN/postinst
+++ b/packaging/deb/meshbay-hub/DEBIAN/postinst
@@ -13,15 +13,16 @@ case "$1" in
                     --gecos "MeshBay service account" meshbay
         fi
 
-        # Create data directory
+        # Create data and log directories
         install -d -o meshbay -g meshbay -m 750 /var/lib/meshbay/hub
         install -d -o meshbay -g meshbay -m 750 /var/log/meshbay
 
-        # Enable and start service
+        # Create config directory (files are placed by the admin, not by us)
+        install -d -m 755 /etc/meshbay
+
+        # Reload systemd if available
         if [ -d /run/systemd/system ]; then
             systemctl daemon-reload || true
-            systemctl enable meshbay-hub.service || true
-            systemctl start meshbay-hub.service || true
         fi
         ;;
 esac
diff --git a/packaging/deb/meshbay-node/DEBIAN/control b/packaging/deb/meshbay-node/DEBIAN/control
index 8d74ee4..0c9d73d 100644
--- a/packaging/deb/meshbay-node/DEBIAN/control
+++ b/packaging/deb/meshbay-node/DEBIAN/control
@@ -1,17 +1,17 @@
 Package: meshbay-node
-Version: 0.2.0
+Version: __VERSION__
 Section: net
 Priority: optional
 Architecture: all
 Maintainer: MeshBay Team <team@meshbay.org>
 Homepage: https://meshbay.org
-Depends: python3 (>= 3.12),
-         python3-meshbay-common (= 0.2.0),
-         adduser
+Depends: meshbay-common (= __VERSION__)
 Recommends: ffmpeg
-Description: MeshBay Node — local file host and streaming server
- MeshBay Node indexes local directories and serves encrypted files
- to authenticated group members over QUIC (MNP v2) or TCP+TLS (MNP v1).
+Description: MeshBay Node — local file host, streaming server, and group daemon
+ MeshBay Node indexes local directories and serves encrypted files to
+ authenticated group members over WebRTC. Includes video streaming (fMP4
+ remux via ffmpeg), group chat, and a local admin UI on localhost:18000.
  .
- Includes a local management web UI at http://localhost:18000.
- Designed to run on a home server or NAS.
+ Installs node code into the shared venv at /opt/meshbay-common/venv/.
+ Ships a default TMDB API token for the Videos app.
+ Runs as a systemd user service.
diff --git a/packaging/deb/meshbay-node/DEBIAN/postinst b/packaging/deb/meshbay-node/DEBIAN/postinst
new file mode 100644
index 0000000..ba16633
--- /dev/null
+++ b/packaging/deb/meshbay-node/DEBIAN/postinst
@@ -0,0 +1,13 @@
+#!/bin/sh
+set -e
+
+case "$1" in
+    configure)
+        # Reload systemd if available
+        if [ -d /run/systemd/system ]; then
+            systemctl daemon-reload || true
+        fi
+        ;;
+esac
+
+#DEBHELPER#