refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/commands/peers.ts

@@ -1,10 +1,13 @@
 /**
  * `claudemesh peers` — list connected peers in the mesh.
  *
- * Connects, fetches the peer list, prints it, disconnects.
+ * Shows all meshes by default, or filter with --mesh.
  */
 
-import { withMesh } from "./connect";
+import { withMesh } from "./connect.js";
+import { readConfig } from "~/services/config/facade.js";
+import { render } from "~/ui/render.js";
+import { bold, dim, green, yellow } from "~/ui/styles.js";
 
 export interface PeersFlags {
   mesh?: string;
@@ -12,44 +15,60 @@ export interface PeersFlags {
 }
 
 export async function runPeers(flags: PeersFlags): Promise<void> {
-  const useColor =
-    !process.env.NO_COLOR && process.env.TERM !== "dumb" && process.stdout.isTTY;
-  const dim = (s: string) => (useColor ? `\x1b[2m${s}\x1b[22m` : s);
-  const bold = (s: string) => (useColor ? `\x1b[1m${s}\x1b[22m` : s);
-  const green = (s: string) => (useColor ? `\x1b[32m${s}\x1b[39m` : s);
-  const yellow = (s: string) => (useColor ? `\x1b[33m${s}\x1b[39m` : s);
+  const config = readConfig();
+  const slugs = flags.mesh ? [flags.mesh] : config.meshes.map((m) => m.slug);
 
-  await withMesh({ meshSlug: flags.mesh ?? null }, async (client, mesh) => {
-    const peers = await client.listPeers();
+  if (slugs.length === 0) {
+    render.err("No meshes joined.");
+    render.hint("claudemesh <invite-url>    # join + launch");
+    process.exit(1);
+  }
 
-    if (flags.json) {
-      console.log(JSON.stringify(peers, null, 2));
-      return;
+  const allJson: Array<{ mesh: string; peers: unknown[] }> = [];
+
+  for (const slug of slugs) {
+    try {
+      await withMesh({ meshSlug: slug }, async (client, mesh) => {
+        const peers = await client.listPeers();
+
+        if (flags.json) {
+          allJson.push({ mesh: mesh.slug, peers });
+          return;
+        }
+
+        render.section(`peers on ${mesh.slug} (${peers.length})`);
+
+        if (peers.length === 0) {
+          render.info(dim("  (no peers connected)"));
+          return;
+        }
+
+        for (const p of peers) {
+          const groups = p.groups.length
+            ? " [" +
+              p.groups
+                .map((g: { name: string; role?: string }) => `@${g.name}${g.role ? `:${g.role}` : ""}`)
+                .join(", ") +
+              "]"
+            : "";
+          const statusDot = p.status === "working" ? yellow("●") : green("●");
+          const name = bold(p.displayName);
+          const meta: string[] = [];
+          if (p.peerType) meta.push(p.peerType);
+          if (p.channel) meta.push(p.channel);
+          if (p.model) meta.push(p.model);
+          const metaStr = meta.length ? dim(` (${meta.join(", ")})`) : "";
+          const summary = p.summary ? dim(`  — ${p.summary}`) : "";
+          render.info(`${statusDot} ${name}${groups}${metaStr}${summary}`);
+          if (p.cwd) render.info(dim(`   cwd: ${p.cwd}`));
+        }
+      });
+    } catch (e) {
+      render.err(`${slug}: ${e instanceof Error ? e.message : String(e)}`);
     }
+  }
 
-    if (peers.length === 0) {
-      console.log(dim(`No peers connected on mesh "${mesh.slug}".`));
-      return;
-    }
-
-    console.log(bold(`Peers on ${mesh.slug}`) + dim(` (${peers.length})`));
-    console.log("");
-    for (const p of peers) {
-      const groups = p.groups.length
-        ? " [" + p.groups.map((g) => `@${g.name}${g.role ? `:${g.role}` : ""}`).join(", ") + "]"
-        : "";
-      const statusIcon = p.status === "working" ? yellow("●") : green("●");
-      const name = bold(p.displayName);
-      const meta: string[] = [];
-      if (p.peerType) meta.push(p.peerType);
-      if (p.channel) meta.push(p.channel);
-      if (p.model) meta.push(p.model);
-      const metaStr = meta.length ? dim(` (${meta.join(", ")})`) : "";
-      const cwdStr = p.cwd ? dim(`  cwd: ${p.cwd}`) : "";
-      const summary = p.summary ? dim(`  ${p.summary}`) : "";
-      console.log(`  ${statusIcon} ${name}${groups}${metaStr}${summary}`);
-      if (cwdStr) console.log(`    ${cwdStr}`);
-    }
-    console.log("");
-  });
+  if (flags.json) {
+    process.stdout.write(JSON.stringify(slugs.length === 1 ? allJson[0]?.peers : allJson, null, 2) + "\n");
+  }
 }