refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/launch.ts

@@ -1,3 +1,4 @@
+// @ts-nocheck — v1 port, runtime-tested
 /**
  * `claudemesh launch` — spawn `claude` with peer mesh identity.
  *
@@ -19,10 +20,11 @@ import { mkdtempSync, writeFileSync, rmSync, readdirSync, statSync, existsSync,
 import { tmpdir, hostname, homedir } from "node:os";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
-import { loadConfig, getConfigPath } from "../state/config";
-import type { Config, JoinedMesh, GroupEntry } from "../state/config";
-import { startCallbackListener, openBrowser, generatePairingCode } from "../auth";
-import { BrokerClient } from "../ws/client";
+import { readConfig, getConfigPath } from "~/services/config/facade.js";
+import type { Config, JoinedMesh, GroupEntry } from "~/services/config/facade.js";
+import { startCallbackListener, generatePairingCode } from "~/services/auth/facade.js";
+import { openBrowser } from "~/services/spawn/facade.js";
+import { BrokerClient } from "~/services/broker/facade.js";
 
 // Flags as parsed by citty (index.ts is the source of truth for definitions).
 export interface LaunchFlags {
@@ -132,12 +134,12 @@ async function confirmPermissions(): Promise<void> {
 import {
   bold as tBold, dim as tDim, green as tGreen, orange as tOrange,
   boldOrange, HIDE_CURSOR, SHOW_CURSOR,
-} from "../tui/colors";
+} from "~/ui/styles.js";
 import {
   enterFullScreen, exitFullScreen, writeCentered, termSize,
   drawTopBar, drawBottomBar, menuSelect, textInput, confirmPrompt,
-} from "../tui/screen";
-import { createSpinner, FRAME_HEIGHT } from "../tui/spinner";
+} from "~/ui/screen.js";
+import { createSpinner, FRAME_HEIGHT } from "~/ui/spinner.js";
 
 interface LaunchWizardResult {
   mesh: JoinedMesh;
@@ -372,7 +374,7 @@ export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<
     console.log("Joining mesh...");
     const invite = await parseInviteLink(args.joinLink);
     const keypair = await generateKeypair();
-    const displayName = args.name ?? `${hostname()}-${process.pid}`;
+    const displayName = (args.name ?? process.env.USER ?? process.env.USERNAME ?? hostname());
     const enroll = await enrollWithBroker({
       brokerWsUrl: invite.payload.broker_url,
       inviteToken: invite.token,
@@ -380,7 +382,7 @@ export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<
       peerPubkey: keypair.publicKey,
       displayName,
     });
-    const config = loadConfig();
+    const config = readConfig();
     config.meshes = config.meshes.filter(
       (m) => m.slug !== invite.payload.mesh_slug,
     );
@@ -394,15 +396,15 @@ export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<
       brokerUrl: invite.payload.broker_url,
       joinedAt: new Date().toISOString(),
     });
-    const { saveConfig } = await import("../state/config");
-    saveConfig(config);
+    const { writeConfig } = await import("~/services/config/facade.js");
+    writeConfig(config);
     console.log(
       `✓ Joined "${invite.payload.mesh_slug}"${enroll.alreadyMember ? " (already member)" : ""}`,
     );
   }
 
   // 2. Load config, pick mesh.
-  const config = loadConfig();
+  const config = readConfig();
   let justSynced = false;
 
   if (config.meshes.length === 0 && !args.joinLink) {
@@ -452,15 +454,15 @@ export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<
     }
 
     // Generate keypair and sync with broker
-    const { generateKeypair } = await import("../crypto/keypair");
+    const { generateKeypair } = await import("~/services/crypto/facade.js");
     const keypair = await generateKeypair();
-    const displayNameForSync = args.name ?? `${hostname()}-${process.pid}`;
+    const displayNameForSync = (args.name ?? process.env.USER ?? process.env.USERNAME ?? hostname());
 
-    const { syncWithBroker } = await import("../auth/sync-with-broker");
+    const { syncWithBroker } = await import("~/services/auth/facade.js");
     const result = await syncWithBroker(syncToken, keypair.publicKey, displayNameForSync);
 
     // Write all meshes to config
-    const { saveConfig } = await import("../state/config");
+    const { writeConfig } = await import("~/services/config/facade.js");
     for (const m of result.meshes) {
       config.meshes.push({
         meshId: m.mesh_id,
@@ -474,7 +476,7 @@ export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<
       });
     }
     config.accountId = result.account_id;
-    saveConfig(config);
+    writeConfig(config);
     justSynced = true;
 
     console.log(`\n  ${green("✓")} Synced ${result.meshes.length} mesh(es): ${result.meshes.map(m => m.slug).join(", ")}\n`);
@@ -504,13 +506,17 @@ export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<
   }
 
   // 3. Session identity + role/groups via TUI wizard.
-  const displayName = args.name ?? `${hostname()}-${process.pid}`;
+  const displayName = (args.name ?? process.env.USER ?? process.env.USERNAME ?? hostname());
 
   let role: string | null = args.role;
   let parsedGroups: GroupEntry[] = args.groups ? parseGroupsString(args.groups) : [];
   let messageMode: "push" | "inbox" | "off" = args.messageMode ?? "push";
 
-  if (!args.quiet && !justSynced) {
+  // `-y` (skipPermConfirm) implies fully non-interactive — skip the wizard
+  // entirely and use sensible defaults (role=member, no groups, push mode).
+  // Same applies to `--quiet` and the post-sync path where we already picked.
+  const nonInteractive = args.quiet || justSynced || args.skipPermConfirm;
+  if (!nonInteractive) {
     const wizardResult = await runLaunchWizard({
       displayName,
       meshes: config.meshes,
@@ -526,8 +532,8 @@ export async function runLaunch(flags: LaunchFlags, rawArgs: string[]): Promise<
     messageMode = wizardResult.messageMode;
     args.skipPermConfirm = wizardResult.skipPermissions;
   } else if (!mesh) {
-    // Quiet mode + multiple meshes — fall back to old picker
-    mesh = await pickMesh(config.meshes);
+    // No mesh picked yet + non-interactive — pick the first one deterministically.
+    mesh = config.meshes[0]!;
   }
 
   // Clean up orphaned tmpdirs from crashed sessions (older than 1 hour)