refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/src/mcp/tools/clock-write.ts

@@ -0,0 +1,4 @@
+// MCP tool family: clock-write
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "clock-write" as const;
+export const TOOLS = ["mesh_set_clock", "mesh_pause_clock", "mesh_resume_clock"] as const;

apps/cli/src/mcp/tools/contexts.ts

@@ -0,0 +1,4 @@
+// MCP tool family: contexts
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "contexts" as const;
+export const TOOLS = ["share_context", "get_context", "list_contexts"] as const;

apps/cli/src/mcp/tools/files.ts

@@ -0,0 +1,4 @@
+// MCP tool family: files
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "files" as const;
+export const TOOLS = ["share_file", "get_file", "list_files", "file_status", "delete_file", "grant_file_access", "read_peer_file", "list_peer_files"] as const;

apps/cli/src/mcp/tools/graph.ts

@@ -0,0 +1,4 @@
+// MCP tool family: graph
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "graph" as const;
+export const TOOLS = ["graph_query", "graph_execute"] as const;

apps/cli/src/mcp/tools/groups.ts

@@ -0,0 +1,4 @@
+// MCP tool family: groups
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "groups" as const;
+export const TOOLS = ["join_group", "leave_group"] as const;

apps/cli/src/mcp/tools/index.ts

@@ -0,0 +1,21 @@
+export { FAMILY as memoryFamily, TOOLS as memoryTools } from "./memory.js";
+export { FAMILY as stateFamily, TOOLS as stateTools } from "./state.js";
+export { FAMILY as messagingFamily, TOOLS as messagingTools } from "./messaging.js";
+export { FAMILY as profileFamily, TOOLS as profileTools } from "./profile.js";
+export { FAMILY as groupsFamily, TOOLS as groupsTools } from "./groups.js";
+export { FAMILY as filesFamily, TOOLS as filesTools } from "./files.js";
+export { FAMILY as vectorsFamily, TOOLS as vectorsTools } from "./vectors.js";
+export { FAMILY as graphFamily, TOOLS as graphTools } from "./graph.js";
+export { FAMILY as sqlFamily, TOOLS as sqlTools } from "./sql.js";
+export { FAMILY as streamsFamily, TOOLS as streamsTools } from "./streams.js";
+export { FAMILY as contextsFamily, TOOLS as contextsTools } from "./contexts.js";
+export { FAMILY as tasksFamily, TOOLS as tasksTools } from "./tasks.js";
+export { FAMILY as schedulingFamily, TOOLS as schedulingTools } from "./scheduling.js";
+export { FAMILY as meshMetaFamily, TOOLS as meshMetaTools } from "./mesh-meta.js";
+export { FAMILY as clockWriteFamily, TOOLS as clockWriteTools } from "./clock-write.js";
+export { FAMILY as skillsFamily, TOOLS as skillsTools } from "./skills.js";
+export { FAMILY as mcpRegistryPeerFamily, TOOLS as mcpRegistryPeerTools } from "./mcp-registry-peer.js";
+export { FAMILY as mcpRegistryBrokerFamily, TOOLS as mcpRegistryBrokerTools } from "./mcp-registry-broker.js";
+export { FAMILY as vaultFamily, TOOLS as vaultTools } from "./vault.js";
+export { FAMILY as urlWatchFamily, TOOLS as urlWatchTools } from "./url-watch.js";
+export { FAMILY as webhooksFamily, TOOLS as webhooksTools } from "./webhooks.js";

apps/cli/src/mcp/tools/mcp-registry-broker.ts

@@ -0,0 +1,4 @@
+// MCP tool family: mcp-registry-broker
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "mcp-registry-broker" as const;
+export const TOOLS = ["mesh_mcp_deploy", "mesh_mcp_undeploy", "mesh_mcp_update", "mesh_mcp_logs", "mesh_mcp_scope", "mesh_mcp_schema", "mesh_mcp_catalog"] as const;

apps/cli/src/mcp/tools/mcp-registry-peer.ts

@@ -0,0 +1,4 @@
+// MCP tool family: mcp-registry-peer
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "mcp-registry-peer" as const;
+export const TOOLS = ["mesh_mcp_register", "mesh_mcp_list", "mesh_tool_call", "mesh_mcp_remove"] as const;

apps/cli/src/mcp/tools/memory.ts

@@ -0,0 +1,4 @@
+// MCP tool family: memory
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "memory" as const;
+export const TOOLS = ["remember", "recall", "forget"] as const;

apps/cli/src/mcp/tools/mesh-meta.ts

@@ -0,0 +1,4 @@
+// MCP tool family: mesh-meta
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "mesh-meta" as const;
+export const TOOLS = ["mesh_info", "mesh_stats", "mesh_clock", "ping_mesh"] as const;

apps/cli/src/mcp/tools/messaging.ts

@@ -0,0 +1,4 @@
+// MCP tool family: messaging
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "messaging" as const;
+export const TOOLS = ["send_message", "list_peers", "check_messages", "message_status"] as const;

apps/cli/src/mcp/tools/profile.ts

@@ -0,0 +1,4 @@
+// MCP tool family: profile
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "profile" as const;
+export const TOOLS = ["set_profile", "set_status", "set_summary", "set_visible"] as const;

apps/cli/src/mcp/tools/scheduling.ts

@@ -0,0 +1,4 @@
+// MCP tool family: scheduling
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "scheduling" as const;
+export const TOOLS = ["schedule_reminder", "list_scheduled", "cancel_scheduled"] as const;

apps/cli/src/mcp/tools/skills.ts

@@ -0,0 +1,4 @@
+// MCP tool family: skills
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "skills" as const;
+export const TOOLS = ["share_skill", "get_skill", "list_skills", "remove_skill", "mesh_skill_deploy"] as const;

apps/cli/src/mcp/tools/sql.ts

@@ -0,0 +1,4 @@
+// MCP tool family: sql
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "sql" as const;
+export const TOOLS = ["mesh_query", "mesh_execute", "mesh_schema"] as const;

apps/cli/src/mcp/tools/state.ts

@@ -0,0 +1,4 @@
+// MCP tool family: state
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "state" as const;
+export const TOOLS = ["set_state", "get_state", "list_state"] as const;

apps/cli/src/mcp/tools/streams.ts

@@ -0,0 +1,4 @@
+// MCP tool family: streams
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "streams" as const;
+export const TOOLS = ["create_stream", "publish", "subscribe", "list_streams"] as const;

apps/cli/src/mcp/tools/tasks.ts

@@ -0,0 +1,4 @@
+// MCP tool family: tasks
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "tasks" as const;
+export const TOOLS = ["create_task", "claim_task", "complete_task", "list_tasks"] as const;

apps/cli/src/mcp/tools/url-watch.ts

@@ -0,0 +1,4 @@
+// MCP tool family: url-watch
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "url-watch" as const;
+export const TOOLS = ["mesh_watch", "mesh_unwatch", "mesh_watches"] as const;

apps/cli/src/mcp/tools/vault.ts

@@ -0,0 +1,4 @@
+// MCP tool family: vault
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "vault" as const;
+export const TOOLS = ["vault_set", "vault_list", "vault_delete"] as const;

apps/cli/src/mcp/tools/vectors.ts

@@ -0,0 +1,4 @@
+// MCP tool family: vectors
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "vectors" as const;
+export const TOOLS = ["vector_store", "vector_search", "vector_delete", "list_collections"] as const;

apps/cli/src/mcp/tools/webhooks.ts

@@ -0,0 +1,4 @@
+// MCP tool family: webhooks
+// Handlers in mcp/server.ts; this file defines the family for the spec's folder structure.
+export const FAMILY = "webhooks" as const;
+export const TOOLS = ["create_webhook", "list_webhooks", "delete_webhook"] as const;