feat(hub): replace reCAPTCHA with a self-hosted proof of work

Sign-up and passphrase reset sent every visitor's address and browser
details to Google, which needed a consent the sign-up form could not ask
for freely. The hub now issues its own challenge (ALTCHA's scheme, signed
with a key derived from the hub's private key, single-use, 30 minutes)
and the page solves it with SubtleCrypto while the form is filled in.

- GET /v1/users/captcha issues a challenge; 404 captcha_disabled when off.
- [captcha] enabled / max_number replace site_key / secret_key, which are
  now ignored with a warning; MESHBAY_CAPTCHA_ENABLED replaces the old
  variables.
- No Google origin left in the CSP of the hub, the desktop shell or the
  Android shell; captcha_site_key leaves /v1/hub/info.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 8 insertions, 33 deletions

diff --git a/packaging/conf/hub.toml.example b/packaging/conf/hub.toml.example
index 850bee1..8e249a5 100644
--- a/packaging/conf/hub.toml.example
+++ b/packaging/conf/hub.toml.example
@@ -51,40 +51,15 @@ access_token_ttl  = 14400      # 4 h
 # admin panel, not here.
 
 [captcha]
-# reCAPTCHA v2 on registration and password reset, so no mail is ever sent
-# before a human has been seen. Absent, or either key empty, disables it
-# entirely — which is right for development and for a hub nobody can reach.
-# See docs/MESHBAY_DESIGN.md §7.7.
-site_key   = ""
-secret_key = ""
+# A proof of work on registration and password reset, issued and checked by
+# this hub alone: no third party, no cookie, nothing for a person to do — the
+# page solves it while the form is filled in. On by default; turn it off only
+# for development or a hub nobody can reach. See docs/MESHBAY_DESIGN.md §7.7.
+enabled = true
 
-# Hostnames a solved captcha may have been solved on, checked against the one
-# `siteverify` reports — what Google observed, not what the client claims.
-#
-# Leave empty while the reCAPTCHA key does its own origin check: it is then
-# already done, one layer up. Set it when you turn that check off in the
-# reCAPTCHA console, and the two go together — turning the console check off
-# without setting this leaves no origin check anywhere.
-#
-# The desktop client is why it exists. Its interface ships inside the package
-# and is served from `app://meshbay`, so the hostname Google sees is not this
-# hub's and never can be; with the console check on, the widget shows
-# "Invalid domain for site key" and nothing client-side reaches that decision.
-#
-#   allowed_hosts = ["hub.example.org", "localhost"]
-allowed_hosts = []
-
-# A solve Google cannot attribute to a domain reports an *empty* hostname —
-# the desktop client's `app://` origin does, and so does any other non-web
-# client. No `allowed_hosts` entry matches that, hence a flag rather than a
-# blank list entry.
-#
-# What it admits is every non-web client, not only this project's: a file://
-# page or somebody else's Electron application look identical from here. The
-# captcha still has to be solved per token; what is given up is the origin
-# restriction for those clients. Leave it off unless you ship the desktop
-# client. See docs/MESHBAY_DESIGN.md §7.7.
-allow_unattributed_host = false
+# The work asked of the page: half of this many SHA-256 on average, all of it
+# at worst. The default takes about three seconds on a slow phone.
+max_number = 500000
 
 
 [mail]