feat(client): the platform seam, and an Electron shell that has never been run

Stage D, and the honest half of it.

D1 — the seam (done, and verified)
----------------------------------
`static/platform.js`. `HUB` becomes `platform.hubBase()` and the transport is
built with the same base, so one address has one source. In a browser it returns
'' and every path stays relative to the origin that served the page — the
acceptance criterion for this split was "the browser SPA behaves identically",
and it does. `platform.js` joins `_ASSETS`, or a change to it would not move the
content hash and a cached browser would never ask for it.

D2 — the shell (written, never launched)
-----------------------------------------
**There is no npm on this machine. Electron was never installed and
`packages/meshbay-client/` has not been run once.** That is stated here rather
than discovered later.

What is there: a main process serving the packaged interface over a privileged
`app://` scheme (`secure` and `standard` are not cosmetic — without them the
service worker refuses to register and streamed downloads break silently), a
preload exposing an enumerated bridge that never passes a filesystem path, a
window with `sandbox`, `contextIsolation` and no node integration, navigation
away from the package refused, and a CSP where the hub is reachable over
connect-src and is not a script source. The hub address arrives as a process
argument because `platform.hubBase()` runs before anything can await.

`test_desktop_shell.py` pins each of those by reading the source — the treatment
`test_downloads.py` already gives the three browser save paths. It catches a
property being removed and proves nothing about the application running. Two
were checked by breaking them.

The interface is *copied* into the package by `build/sync-ui.js` from the hub's
static directory, and `ui/` is gitignored: a silent fork is the only real way to
end up maintaining the interface twice.

D3 — partial
------------
The bridge, and the part worth having now: safeStorage's backend is reported
rather than assumed. On Linux it falls back to a fixed key when no keyring is
running, silently — someone who believes the OS is holding their keys is told
when it is not. The native key lifecycle belongs with D4 and needs a running
application to mean anything.

D8 — partial, and a real defect found
--------------------------------------
`meshbay-node.spec` installed the SYSTEM template — the one carrying `User=%i` —
into `%{_userunitdir}`. A user unit already runs as its owner and cannot carry
`User=`; systemd refuses the file, so the packaged unit could never have
started. Nothing noticed because nobody had built and installed the RPM.

Two units now: the template to `%{_unitdir}`, and a new `meshbay-node-user.service`
that a person enables themselves without a password — which is what lets the
desktop client install a node without asking for one. It carries ExecReload, so
`meshbay-node reload` does not have to stop a service somebody is streaming from,
and documents the drop-in for a drive outside the home, RequiresMountsFor
included.

798 tests pass; e2e.py still passes end to end. Nothing here was built or
launched: no npm, no rpmbuild.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 10 insertions, 1 deletions

diff --git a/packaging/rpm/meshbay-node.spec b/packaging/rpm/meshbay-node.spec
index 7052cff..5f28c52 100644
--- a/packaging/rpm/meshbay-node.spec
+++ b/packaging/rpm/meshbay-node.spec
@@ -40,8 +40,16 @@ Includes a local web UI at http://localhost:18000.
 %install
 %{python3} -m pip install --root %{buildroot} --no-index --find-links dist meshbay-node
 
-# systemd user service (template)
+# Two units, because there are two personas and one file cannot be both.
+#
+# The SYSTEM template carries User=%%i and is instantiated per person by root
+# (`systemctl enable --now meshbay-node@alice`) — the server case. A *user* unit
+# cannot carry User= at all: it already runs as its owner, and systemd refuses
+# the file. This spec used to install the template into the user unit directory,
+# where it could never have started.
 install -Dm644 packaging/systemd/meshbay-node.service \
+    %{buildroot}%{_unitdir}/meshbay-node@.service
+install -Dm644 packaging/systemd/meshbay-node-user.service \
     %{buildroot}%{_userunitdir}/meshbay-node.service
 
 %files
@@ -50,6 +58,7 @@ install -Dm644 packaging/systemd/meshbay-node.service \
 %{python3_sitelib}/meshbay_node/
 %{python3_sitelib}/meshbay_node-*.dist-info/
 %{_bindir}/meshbay-node
+%{_unitdir}/meshbay-node@.service
 %{_userunitdir}/meshbay-node.service
 
 %changelog