fix(node): read the packaged TMDB token in place

A node onboarded by the desktop client never ran `init`, so default.env was
never copied to node.env; and default.env was 0600 root, unreadable to a
per-user node anyway. The daemon now loads it beneath node.env, 0644.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 11 insertions, 10 deletions

diff --git a/packaging/README.md b/packaging/README.md
index b65d0ed..6081fc7 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -95,7 +95,7 @@ no key-generation step to run by hand.
 ## Post-install (node)
 
 ```bash
-meshbay-node init                   # copies default.env (with TMDB token)
+meshbay-node init
 nano ~/.config/meshbay/node.toml
 systemctl --user enable --now meshbay-node
 ```
diff --git a/packaging/build/build-node.sh b/packaging/build/build-node.sh
index 8970176..fde67a5 100755
--- a/packaging/build/build-node.sh
+++ b/packaging/build/build-node.sh
@@ -45,8 +45,10 @@ ln -sf /opt/meshbay-common/venv/bin/meshbay-node "$ROOT/usr/bin/meshbay-node"
 # --- Node-specific assets -------------------------------------------------
 mkdir -p "$ROOT/opt/meshbay-node/share"
 
-# Default env with the shared TMDB token, read at build time and copied to
-# <config>/node.env by `meshbay-node init`.
+# Default env with the shared TMDB token, read at build time. The daemon reads
+# it in place, beneath <config>/node.env, so it must be readable by whoever runs
+# the node -- 0600 root made it unreadable to every per-user node. It is the
+# same token in every copy of the package, so 0644 hides nothing.
 #
 # tmdb.py sends `Authorization: Bearer`, so this is the v4 *read access token*
 # (a JWT, "eyJ..."), not the 32-char v3 API key that sits beside it in the same
@@ -72,13 +74,12 @@ fi
 if [ -n "$TMDB_TOKEN" ]; then
     cat > "$ROOT/opt/meshbay-node/share/default.env" <<EOF
 # Default environment for meshbay-node.
-# Copied to <config>/node.env by 'meshbay-node init' if it does not exist.
-# The operator may override any value there or in the systemd EnvironmentFile.
+# Read by the daemon beneath <config>/node.env; set a value there to override it.
 
 # TMDB API token for the Videos app (read-only, shared across installations)
 MESHBAY_TMDB_DEFAULT_TOKEN=$TMDB_TOKEN
 EOF
-    chmod 600 "$ROOT/opt/meshbay-node/share/default.env"
+    chmod 644 "$ROOT/opt/meshbay-node/share/default.env"
     echo "    TMDB token baked into default.env (${#TMDB_TOKEN} chars)"
 elif [ "${MESHBAY_ALLOW_NO_TMDB:-0}" = "1" ]; then
     echo "    !! no TMDB token; default.env left empty (MESHBAY_ALLOW_NO_TMDB=1)" >&2
diff --git a/packaging/win/build-node-runtime.ps1 b/packaging/win/build-node-runtime.ps1
index 20eacc8..28c4061 100644
--- a/packaging/win/build-node-runtime.ps1
+++ b/packaging/win/build-node-runtime.ps1
@@ -120,9 +120,9 @@ else {
 
 # --- 5. default.env (shared TMDB token) ------------------------------
 # Beside the exe, where platform.packaged_default_env() looks for it, and the
-# same placement ffmpeg gets above. `meshbay-node init` copies it to
-# %LOCALAPPDATA%\meshbay\node.env, and the daemon loads that file itself:
-# Windows autostart is a Startup-folder .vbs, with no systemd EnvironmentFile.
+# same placement ffmpeg gets above. The daemon reads it in place, beneath
+# %LOCALAPPDATA%\meshbay\node.env: Windows autostart is a Startup-folder .vbs,
+# with no systemd EnvironmentFile.
 function Get-TmdbToken([string]$File) {
     if (-not $File -or -not (Test-Path -LiteralPath $File)) { return "" }
     $lines = Get-Content -LiteralPath $File
@@ -149,7 +149,7 @@ $noBom = New-Object System.Text.UTF8Encoding $false   # a BOM would break parsin
 if ($tmdb) {
     $body = @(
         "# Default environment for meshbay-node.",
-        "# Copied to <config>\node.env by 'meshbay-node init' if it does not exist.",
+        "# Read by the daemon beneath <config>\node.env; set a value there to override it.",
         "",
         "# TMDB API token for the Videos app (read-only, shared across installations)",
         "MESHBAY_TMDB_DEFAULT_TOKEN=$tmdb"