feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 21 insertions, 86 deletions

diff --git a/packaging/rpm/meshbay-hub.spec b/packaging/rpm/meshbay-hub.spec
index dd4803f..73df0b9 100644
--- a/packaging/rpm/meshbay-hub.spec
+++ b/packaging/rpm/meshbay-hub.spec
@@ -1,61 +1,38 @@
 Name:           meshbay-hub
-Version:        0.6.0
+Version:        __VERSION__
 Release:        1%{?dist}
 Summary:        MeshBay Hub — identity authority and group registry server
 License:        AGPLv3+
 URL:            https://meshbay.org
-Source0:        %{name}-%{version}.tar.gz
 
+AutoReqProv:    no
 BuildArch:      noarch
-BuildRequires:  python3-devel >= 3.12
-BuildRequires:  python3-pip
-BuildRequires:  python3-hatchling
 
-Requires:       python3 >= 3.12
-Requires:       python3-meshbay-common = %{version}
-Requires:       python3-fastapi
-Requires:       python3-uvicorn
-Requires:       python3-sqlalchemy >= 2.0
-Requires:       python3-alembic
-Requires:       python3-asyncpg
-Requires:       python3-pyjwt
-Requires:       python3-blake3
-Requires:       python3-slowapi
-Requires:       postgresql-server
+Requires:       meshbay-common = %{version}
+Recommends:     caddy
+Recommends:     postgresql-server
 
 %description
-MeshBay Hub provides identity management, group registry,
-GEK bundle distribution, and coordination for MeshBay nodes.
-Runs as a systemd service behind Caddy (HTTPS).
+MeshBay Hub provides user registration, JWT issuance, group management,
+WebRTC signaling, notifications, and moderation for MeshBay networks.
 
-%prep
-%autosetup
-
-%build
-%{python3} -m pip wheel --no-deps --wheel-dir dist .
+Installs hub code into the shared venv at /opt/meshbay-common/venv/.
+Runs as a systemd service behind Caddy for HTTPS.
 
 %install
-%{python3} -m pip install --root %{buildroot} --no-index --find-links dist meshbay-hub
-
-# systemd service
-install -Dm644 packaging/systemd/meshbay-hub.service \
-    %{buildroot}%{_unitdir}/meshbay-hub.service
-
-# Config file template
-install -Dm644 packaging/conf/hub.toml.example \
-    %{buildroot}%{_sysconfdir}/meshbay/hub.toml.example
-
-# Data directory
-install -d %{buildroot}%{_sharedstatedir}/meshbay/hub
+cp -a %{_staging_root}/* %{buildroot}/
 
 %pre
 getent group meshbay >/dev/null || groupadd -r meshbay
 getent passwd meshbay >/dev/null || \
-    useradd -r -g meshbay -d %{_sharedstatedir}/meshbay -s /sbin/nologin \
+    useradd -r -g meshbay -d /var/lib/meshbay -s /sbin/nologin \
             -c "MeshBay service account" meshbay
 
 %post
 %systemd_post meshbay-hub.service
+install -d -o meshbay -g meshbay -m 750 /var/lib/meshbay/hub
+install -d -o meshbay -g meshbay -m 750 /var/log/meshbay
+install -d -m 755 /etc/meshbay
 
 %preun
 %systemd_preun meshbay-hub.service
@@ -64,55 +41,13 @@ getent passwd meshbay >/dev/null || \
 %systemd_postun_with_restart meshbay-hub.service
 
 %files
-%license LICENSE
-%doc README.md
-%{python3_sitelib}/meshbay_hub/
-%{python3_sitelib}/meshbay_hub-*.dist-info/
-%{_bindir}/meshbay-hub
+/opt/meshbay-hub
+/opt/meshbay-common/venv/lib/python*/site-packages/meshbay_hub/
+/opt/meshbay-common/venv/lib/python*/site-packages/meshbay_hub-*.dist-info/
+/opt/meshbay-common/venv/bin/meshbay-hub
+/usr/bin/meshbay-hub
 %{_unitdir}/meshbay-hub.service
-%config(noreplace) %{_sysconfdir}/meshbay/hub.toml.example
-%dir %attr(750, meshbay, meshbay) %{_sharedstatedir}/meshbay/hub
 
 %changelog
-* Sun Aug 23 2026 MeshBay Team <team@meshbay.org> - 0.6.0-1
-- Group UI split into a pluggable "applications" architecture (Chat, Files
-  today; Videos/Music/Photos can register without touching GroupPage)
-- Operators can enable/disable applications per group from Settings
-- Group Settings sections reordered: Invite, Pairing, Applications, Shared
-  directories, Uploads, danger zone, Your devices, Members
-- Fixed: a fresh access token was never picked up when a "not a member"
-  handshake retry fired, wrongly locking a member (including a group's own
-  creator) out of a group they had just joined
-- Fixed: opening Chat on a group with existing messages threw and wedged the
-  page's rendering, leaving every button unresponsive until reload
-
-* Sun Aug 16 2026 MeshBay Team <team@meshbay.org> - 0.5.0-1
-- Leave a group; public groups capped at 10 per owner, staff exempt
-- Groups are listed only once a node has announced them; prune-groups collects the rest
-- Node presence dot in the sidebar, from the signaling registry — no polling
-- Chat opens on the newest 100 messages and pages backwards (it used to page forwards)
-- Profile split out of Settings; public groups are open, invite-only is private
-- Streamed downloads verify the service worker is really serving before writing
-- Static assets are revalidated, so a half-updated SPA cannot load
-
-* Sun Aug 16 2026 MeshBay Team <team@meshbay.org> - 0.4.0-1
-- Web client translated into fr, es, pt-BR, zh-CN, ja, de, it, nl and pl
-- Catalogues load on demand, one file per language, English as fallback
-- Plural forms selected through Intl.PluralRules (Polish needs four)
-- Locale matching keeps the region, so pt-BR and zh-CN resolve
-- Static assets are revalidated, so a half-updated SPA cannot load
-
-* Sat Aug 15 2026 MeshBay Team <team@meshbay.org> - 0.3.0-1
-- Transfers survive leaving a group; downloads stream to disk in every browser
-- Download a folder as a zip, built in the browser (zip64, store-only)
-- Group owner can remove a member; editable group description
-- Nodes are recorded at the address their signed announcement arrived from
-- Deleted accounts stop being counted; the connection log keeps their name
-
-* Fri Aug 14 2026 MeshBay Team <team@meshbay.org> - 0.2.0-1
-- Hub no longer stores or publishes user identity keys (H3); schema migration
-- Access tokens carry no pk_user claim
-- SPA: Argon2id for the keypair bundle, per-node identity, invitation codes
-
-* Sat Aug 09 2026 MeshBay Team <team@meshbay.org> - 0.1.0-1
-- Initial package
+* Sun Aug 31 2026 MeshBay Team <team@meshbay.org> - %{version}-1
+- Packaging overhaul: installs into shared venv under /opt