feat(broker): verify ed25519 hello signature against member pubkey

WS handshake is now authenticated end-to-end. The broker proves that
every connected peer actually holds the secret key for the pubkey
they claim as identity — not just that they know the pubkey.

wire format change:
  {type:"hello", meshId, memberId, pubkey, sessionId, pid, cwd,
   timestamp, signature}
  where signature = ed25519_sign(canonical, secretKey)
  and canonical = `${meshId}|${memberId}|${pubkey}|${timestamp}`

broker verifies on every hello:
1. timestamp within ±60s of broker clock → else close(1008, timestamp_skew)
2. pubkey is 64 hex chars, signature is 128 hex chars → else malformed
3. crypto_sign_verify_detached(signature, canonical, pubkey) → else bad_signature
4. (existing) mesh.member row exists for (meshId, pubkey) → else unauthorized

All rejection paths close the WS with code 1008 + structured error
message + metrics counter increment (connections_rejected_total by
reason).

new modules:
- apps/broker/src/crypto.ts: canonicalHello, verifyHelloSignature,
  HELLO_SKEW_MS constant
- apps/cli/src/crypto/hello-sig.ts: matching signHello helper

clients updated:
- apps/cli/src/ws/client.ts: signs hello before send
- apps/broker/scripts/{peer-a,peer-b}.ts (smoke-test): sign hellos
  with seed-provided secret keys

new regression tests — tests/hello-signature.test.ts (7):
- valid signature accepted
- bad signature (signed with wrong key) rejected
- timestamp too old rejected (>60s)
- timestamp too far in future rejected (>60s)
- tampered canonical field (different meshId at verify time) rejected
- malformed hex pubkey rejected
- malformed signature length rejected

verified live:
- apps/broker/scripts/smoke-test.sh: full hello+ack+send+push flow
- apps/cli/scripts/roundtrip.ts: signed hello + encrypted message
- 55/55 tests pass

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/broker/src/index.ts

@@ -42,6 +42,7 @@ import { metrics, metricsToText } from "./metrics";
 import { TokenBucket } from "./rate-limit";
 import { isDbHealthy, startDbHealth, stopDbHealth } from "./db-health";
 import { buildInfo } from "./build-info";
+import { verifyHelloSignature } from "./crypto";
 
 const PORT = env.BROKER_PORT;
 const WS_PATH = "/ws";
@@ -364,6 +365,26 @@ async function handleHello(
     ws.close(1008, "capacity");
     return null;
   }
+  // Signature + skew check. Proves the client holds the secret key
+  // for the pubkey they're claiming as identity.
+  const sig = await verifyHelloSignature({
+    meshId: hello.meshId,
+    memberId: hello.memberId,
+    pubkey: hello.pubkey,
+    timestamp: hello.timestamp,
+    signature: hello.signature,
+  });
+  if (!sig.ok) {
+    metrics.connectionsRejected.inc({ reason: sig.reason });
+    log.warn("hello sig rejected", {
+      reason: sig.reason,
+      mesh_id: hello.meshId,
+      pubkey: hello.pubkey?.slice(0, 12),
+    });
+    sendError(ws, sig.reason, `hello rejected: ${sig.reason}`);
+    ws.close(1008, sig.reason);
+    return null;
+  }
   const member = await findMemberByPubkey(hello.meshId, hello.pubkey);
   if (!member) {
     metrics.connectionsRejected.inc({ reason: "unauthorized" });