feat(cli): scaffold @claudemesh/cli MCP client package (stubs)

The user-facing tool. Two invocation modes:
  - `claudemesh mcp`           → MCP server (stdio), consumed by Claude Code
  - `claudemesh <subcommand>`  → human CLI

Layout:
  apps/cli/
  ├── package.json       bin: { claudemesh: ./src/index.ts }
  ├── README.md          install + usage
  └── src/
      ├── index.ts       dispatcher (mcp | install | join | list | leave | --help)
      ├── env.ts         CLAUDEMESH_BROKER_URL, CONFIG_DIR, DEBUG
      ├── mcp/
      │   ├── server.ts  MCP stdio server with 5 tools
      │   ├── tools.ts   tool schemas (send_message, list_peers,
      │   │              check_messages, set_summary, set_status)
      │   └── types.ts
      ├── ws/client.ts   broker connection (stub for 15b)
      ├── state/config.ts ~/.claudemesh/config.json (joined meshes + keys)
      └── commands/
          ├── install.ts print `claude mcp add ...` instruction
          ├── join.ts    parse ic://join/... (stub, Step 17)
          ├── list.ts    show joined meshes
          └── leave.ts   remove mesh from local config

Tool stubs return "not connected, run `claudemesh join <invite-link>`"
errors until 15b wires the WS client.

Verified:
- `bun src/index.ts --help` → prints usage
- `bun src/index.ts install` → prints MCP add command with resolved path
- `bun src/index.ts list` → "No meshes joined yet"
- `bun src/index.ts mcp` (via stdin) → returns tools/list with all 5 tools

Deps: @modelcontextprotocol/sdk, ws, libsodium-wrappers, zod.
Lockfile regenerated in the same commit per claudemesh-3's flag —
avoids breaking Coolify's --frozen-lockfile deploys.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/state/config.ts

@@ -0,0 +1,58 @@
+/**
+ * Local persistent config — ~/.claudemesh/config.json
+ *
+ * Stores: joined meshes, per-mesh identity keys (ed25519 keypairs),
+ * last-seen broker URL. Loaded on CLI start, on MCP server start,
+ * and on every join/leave.
+ */
+
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import { z } from "zod";
+import { env } from "../env";
+
+const joinedMeshSchema = z.object({
+  meshId: z.string(),
+  memberId: z.string(),
+  slug: z.string(),
+  name: z.string(),
+  pubkey: z.string(), // ed25519 hex (32 bytes = 64 chars)
+  secretKey: z.string(), // ed25519 hex (64 bytes = 128 chars)
+  brokerUrl: z.string(),
+  joinedAt: z.string(),
+});
+
+const configSchema = z.object({
+  version: z.literal(1).default(1),
+  meshes: z.array(joinedMeshSchema).default([]),
+});
+
+export type JoinedMesh = z.infer<typeof joinedMeshSchema>;
+export type Config = z.infer<typeof configSchema>;
+
+const CONFIG_DIR = env.CLAUDEMESH_CONFIG_DIR ?? join(homedir(), ".claudemesh");
+const CONFIG_PATH = join(CONFIG_DIR, "config.json");
+
+export function loadConfig(): Config {
+  if (!existsSync(CONFIG_PATH)) {
+    return configSchema.parse({ version: 1, meshes: [] });
+  }
+  try {
+    const raw = readFileSync(CONFIG_PATH, "utf-8");
+    return configSchema.parse(JSON.parse(raw));
+  } catch (e) {
+    throw new Error(
+      `Failed to load ${CONFIG_PATH}: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+}
+
+export function saveConfig(config: Config): void {
+  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
+  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", "utf-8");
+}
+
+export function getConfigPath(): string {
+  return CONFIG_PATH;
+}