refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/list.ts

@@ -1,30 +1,104 @@
 /**
- * `claudemesh list` — show all joined meshes + their status.
+ * `claudemesh mesh list` — merged view of server + local meshes.
  */
 
-import { loadConfig, getConfigPath } from "../state/config";
+import { readConfig, getConfigPath } from "~/services/config/facade.js";
+import { getStoredToken } from "~/services/auth/facade.js";
+import { request } from "~/services/api/facade.js";
+import { URLS } from "~/constants/urls.js";
+import { bold, dim, green, yellow, red } from "~/ui/styles.js";
 
-export function runList(): void {
-  const config = loadConfig();
-  if (config.meshes.length === 0) {
-    console.log("No meshes joined yet.");
-    console.log("");
-    console.log(
-      "Join one with: claudemesh join https://claudemesh.com/join/<token>",
-    );
-    console.log(`Config file:   ${getConfigPath()}`);
+const BROKER_HTTP = URLS.BROKER.replace("wss://", "https://").replace("ws://", "http://").replace("/ws", "");
+
+interface ServerMesh {
+  id: string;
+  slug: string;
+  name: string;
+  role: string;
+  is_owner: boolean;
+  member_count: number;
+  active_peers: number;
+  joined_at: string;
+}
+
+export async function runList(): Promise<void> {
+  const config = readConfig();
+  const auth = getStoredToken();
+
+  // Try to fetch from server
+  let serverMeshes: ServerMesh[] = [];
+  if (auth) {
+    try {
+      let userId = "";
+      try {
+        const payload = JSON.parse(Buffer.from(auth.session_token.split(".")[1]!, "base64url").toString()) as { sub?: string };
+        userId = payload.sub ?? "";
+      } catch {}
+
+      if (userId) {
+        const res = await request<{ meshes: ServerMesh[] }>({
+          path: `/cli/meshes?user_id=${userId}`,
+          baseUrl: BROKER_HTTP,
+        });
+        serverMeshes = res.meshes ?? [];
+      }
+    } catch {}
+  }
+
+  // Merge: server meshes + local-only meshes
+  const localSlugs = new Set(config.meshes.map(m => m.slug));
+  const serverSlugs = new Set(serverMeshes.map(m => m.slug));
+
+  const allSlugs = new Set([...localSlugs, ...serverSlugs]);
+
+  if (allSlugs.size === 0) {
+    console.log("\n  No meshes yet.\n");
+    console.log("  Create one:  claudemesh mesh create <name>");
+    console.log("  Join one:    claudemesh mesh add <invite-url>\n");
     return;
   }
-  console.log(`Joined meshes (${config.meshes.length}):`);
-  console.log("");
-  for (const m of config.meshes) {
-    console.log(`  ${m.name} (${m.slug})`);
-    console.log(`    mesh id:   ${m.meshId}`);
-    console.log(`    member id: ${m.memberId}`);
-    console.log(`    pubkey:    ${m.pubkey.slice(0, 16)}…`);
-    console.log(`    broker:    ${m.brokerUrl}`);
-    console.log(`    joined:    ${m.joinedAt}`);
-    console.log("");
+
+  console.log("\n  Your meshes:\n");
+
+  for (const slug of allSlugs) {
+    const local = config.meshes.find(m => m.slug === slug);
+    const server = serverMeshes.find(m => m.slug === slug);
+
+    const name = server?.name ?? local?.name ?? slug;
+    const role = server?.role ?? "member";
+    const isOwner = server?.is_owner ?? false;
+    const roleLabel = isOwner ? "owner" : role;
+    const memberCount = server?.member_count;
+    const activePeers = server?.active_peers ?? 0;
+
+    // Status indicator
+    const inLocal = localSlugs.has(slug);
+    const inServer = serverSlugs.has(slug);
+    let status: string;
+    let icon: string;
+
+    if (inLocal && inServer) {
+      icon = green("●");
+      status = activePeers > 0 ? green(`${activePeers} online`) : dim("synced");
+    } else if (inLocal && !inServer) {
+      icon = yellow("●");
+      status = yellow("local only");
+    } else {
+      icon = dim("○");
+      status = dim("not added locally");
+    }
+
+    const memberInfo = memberCount ? dim(`${memberCount} member${memberCount !== 1 ? "s" : ""}`) : "";
+    const parts = [roleLabel, memberInfo, status].filter(Boolean);
+
+    console.log(`    ${icon} ${bold(name)}  ${dim(slug)}`);
+    console.log(`      ${parts.join("  ·  ")}`);
   }
-  console.log(`Config: ${getConfigPath()}`);
+
+  console.log("");
+  if (serverMeshes.some(m => !localSlugs.has(m.slug))) {
+    console.log(dim("    ○ = server only — run `claudemesh mesh add` to use locally"));
+  }
+  console.log(dim(`    Config: ${getConfigPath()}`));
+  console.log("");
 }