feat(packaging): 4-package .deb/.rpm build system under /opt

Shared venv architecture: meshbay-common owns the Python venv with all
pip deps pre-installed; hub and node add only their code into it.
Client is a standalone Electron app. No pip runs at install time.

- Add build scripts (packaging/build/) for common, hub, node, client
- Add orchestrator build-packages.sh with deb/rpm auto-detection
- Add .deb control/postinst for all 4 packages
- Add .rpm specs for all 4 packages (replaces python3-meshbay-common)
- Add Gnome .desktop launcher and icon resizing
- Add firewalld services (meshbay-cast, meshbay-node) and UFW profiles
- Update systemd units to use /opt/meshbay-common/venv/bin/ paths
- TMDB token baked into node package at build time via QE/node.env
- Fix package-lock.json sync for protobufjs override

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

1 files changed, 28 insertions, 71 deletions

diff --git a/packaging/rpm/meshbay-node.spec b/packaging/rpm/meshbay-node.spec
index e4f386e..20d69bc 100644
--- a/packaging/rpm/meshbay-node.spec
+++ b/packaging/rpm/meshbay-node.spec
@@ -1,92 +1,49 @@
 Name:           meshbay-node
-Version:        0.6.0
+Version:        __VERSION__
 Release:        1%{?dist}
 Summary:        MeshBay Node — local file host, streaming server, and group daemon
 License:        AGPLv3+
 URL:            https://meshbay.org
-Source0:        %{name}-%{version}.tar.gz
 
+AutoReqProv:    no
 BuildArch:      noarch
-BuildRequires:  python3-devel >= 3.12
-BuildRequires:  python3-pip
-BuildRequires:  python3-hatchling
 
-Requires:       python3 >= 3.12
-Requires:       python3-meshbay-common = %{version}
-Requires:       python3-fastapi
-Requires:       python3-uvicorn
-Requires:       python3-httpx
-Requires:       python3-watchdog
-Requires:       python3-aioquic >= 1.0
-Requires:       python3-aioice
-Requires:       python3-pyjwt
-Requires:       python3-blake3
-Requires:       python3-msgpack
-Requires:       python3-zstandard
-# Optional: ffmpeg for HLS streaming
+Requires:       meshbay-common = %{version}
 Recommends:     ffmpeg
 
 %description
-MeshBay Node indexes local directories and serves encrypted files
-to authenticated group members over QUIC (MNP v2) or TCP+TLS (MNP v1).
-Includes a local web UI at http://localhost:18000.
+MeshBay Node indexes local directories and serves encrypted files to
+authenticated group members over WebRTC. Includes video streaming (fMP4
+remux via ffmpeg), group chat, and a local admin UI on localhost:18000.
 
-%prep
-%autosetup
-
-%build
-%{python3} -m pip wheel --no-deps --wheel-dir dist .
+Installs node code into the shared venv at /opt/meshbay-common/venv/.
+Ships a default TMDB API token for the Videos app.
+Runs as a systemd user service.
 
 %install
-%{python3} -m pip install --root %{buildroot} --no-index --find-links dist meshbay-node
+cp -a %{_staging_root}/* %{buildroot}/
+
+%post
+if [ -d /run/systemd/system ]; then
+    systemctl daemon-reload || true
+fi
 
-# Two units, because there are two personas and one file cannot be both.
-#
-# The SYSTEM template carries User=%%i and is instantiated per person by root
-# (`systemctl enable --now meshbay-node@alice`) — the server case. A *user* unit
-# cannot carry User= at all: it already runs as its owner, and systemd refuses
-# the file. This spec used to install the template into the user unit directory,
-# where it could never have started.
-install -Dm644 packaging/systemd/meshbay-node.service \
-    %{buildroot}%{_unitdir}/meshbay-node@.service
-install -Dm644 packaging/systemd/meshbay-node-user.service \
-    %{buildroot}%{_userunitdir}/meshbay-node.service
+%preun
+if [ -d /run/systemd/system ]; then
+    systemctl daemon-reload || true
+fi
 
 %files
-%license LICENSE
-%doc README.md
-%{python3_sitelib}/meshbay_node/
-%{python3_sitelib}/meshbay_node-*.dist-info/
-%{_bindir}/meshbay-node
+/opt/meshbay-node
+/opt/meshbay-common/venv/lib/python*/site-packages/meshbay_node/
+/opt/meshbay-common/venv/lib/python*/site-packages/meshbay_node-*.dist-info/
+/opt/meshbay-common/venv/bin/meshbay-node
+/usr/bin/meshbay-node
 %{_unitdir}/meshbay-node@.service
 %{_userunitdir}/meshbay-node.service
+/usr/lib/firewalld/services/meshbay-node.xml
+/etc/ufw/applications.d/meshbay
 
 %changelog
-* Sun Aug 23 2026 MeshBay Team <team@meshbay.org> - 0.6.0-1
-- Per-group application enablement: roster setting, signed apps_enabled op,
-  enforced by the same admin-authority check as member_upload
-
-* Sun Aug 16 2026 MeshBay Team <team@meshbay.org> - 0.5.0-1
-- Abandoned video streams release their transcode slot at once
-- Background tasks are held, so none is collected mid-flight losing a slot
-- ffmpeg is reaped without deadlocking on its own unread output
-- Chunk replies wait for room on the channel instead of queueing 8 MB
-- Chat history pages backwards; upload names accept any script, and errors name the file
-
-* Sun Aug 16 2026 MeshBay Team <team@meshbay.org> - 0.4.0-1
-- No functional change; released in step with the other packages
-
-* Sat Aug 15 2026 MeshBay Team <team@meshbay.org> - 0.3.0-1
-- Video streaming is paced by the client; stream_stop frees the transcode slot
-- Operator can remove an empty directory and revoke a member over MNP
-- meshbay-node group add: host another of your hub groups
-- admin_pk_ed25519 removed; the roster is the only source of node authority
-
-* Fri Aug 14 2026 MeshBay Team <team@meshbay.org> - 0.2.0-1
-- Node wraps the group key itself; members are admitted from a local roster
-- Identity keys are per node, created at first contact and pinned there
-- Operator surface over SSH: operator pair, member list|invite|revoke|unpin
-- Unauthenticated HTTP file API and TCP transport removed (C1, C6)
-
-* Sat Aug 09 2026 MeshBay Team <team@meshbay.org> - 0.1.0-1
-- Initial package
+* Sun Aug 31 2026 MeshBay Team <team@meshbay.org> - %{version}-1
+- Packaging overhaul: installs into shared venv under /opt