refactor: rename cli-v2 → cli, archive legacy cli, plus broker-side grants + auto-migrate

- apps/cli/ is now the canonical CLI (was apps/cli-v2/).
- apps/cli/ legacy v0 archived as branch 'legacy-cli-archive' and tag
  'cli-v0-legacy-final' before deletion; git history preserves it too.
- .github/workflows/release-cli.yml paths updated.
- pnpm-lock.yaml regenerated.

Broker-side peer-grant enforcement (spec: 2026-04-15-per-peer-capabilities):
- 0020_peer-grants.sql adds peer_grants jsonb + GIN index on mesh.member.
- handleSend in broker fetches recipient grant maps once per send, drops
  messages silently when sender lacks the required capability.
- POST /cli/mesh/:slug/grants to update from CLI; broker_messages_dropped_by_grant_total metric.
- CLI grant/revoke/block now mirror to broker via syncToBroker.

Auto-migrate on broker startup:
- apps/broker/src/migrate.ts runs drizzle migrate with pg_advisory_lock
  before the HTTP server binds. Exits non-zero on failure so Coolify
  healthcheck fails closed.
- Dockerfile copies packages/db/migrations into /app/migrations.
- postgres 3.4.5 added as direct broker dep.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/cli/tests/unit/utils.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from "vitest";
+import { levenshtein } from "~/utils/levenshtein.js";
+import { toSlug } from "~/utils/slug.js";
+import { isInviteUrl, extractInviteCode } from "~/utils/url.js";
+import { formatBytes, formatDuration } from "~/utils/format.js";
+import { isNewer } from "~/utils/semver.js";
+
+describe("levenshtein", () => {
+  it("identical strings = 0", () => { expect(levenshtein("abc", "abc")).toBe(0); });
+  it("empty vs non-empty", () => { expect(levenshtein("", "abc")).toBe(3); });
+  it("single edit", () => { expect(levenshtein("kitten", "sitten")).toBe(1); });
+  it("full transform", () => { expect(levenshtein("kitten", "sitting")).toBe(3); });
+});
+
+describe("toSlug", () => {
+  it("lowercases and replaces spaces", () => { expect(toSlug("My Team")).toBe("my-team"); });
+  it("strips special chars", () => { expect(toSlug("test@#$mesh")).toBe("test-mesh"); });
+  it("trims dashes", () => { expect(toSlug("--hello--")).toBe("hello"); });
+});
+
+describe("isInviteUrl", () => {
+  it("matches https claudemesh.com/i/", () => { expect(isInviteUrl("https://claudemesh.com/i/ABC123")).toBe(true); });
+  it("matches ic:// protocol", () => { expect(isInviteUrl("ic://ABC123")).toBe(true); });
+  it("rejects random URL", () => { expect(isInviteUrl("https://example.com")).toBe(false); });
+});
+
+describe("extractInviteCode", () => {
+  it("extracts from /i/ URL", () => { expect(extractInviteCode("https://claudemesh.com/i/AB12CD34")).toBe("AB12CD34"); });
+  it("extracts from ic:// URL", () => { expect(extractInviteCode("ic://XY99")).toBe("XY99"); });
+  it("returns null for invalid", () => { expect(extractInviteCode("https://example.com")).toBeNull(); });
+});
+
+describe("formatBytes", () => {
+  it("bytes", () => { expect(formatBytes(500)).toBe("500 B"); });
+  it("kilobytes", () => { expect(formatBytes(2048)).toBe("2.0 KB"); });
+  it("megabytes", () => { expect(formatBytes(5 * 1024 * 1024)).toBe("5.0 MB"); });
+});
+
+describe("formatDuration", () => {
+  it("milliseconds", () => { expect(formatDuration(500)).toBe("500ms"); });
+  it("seconds", () => { expect(formatDuration(3500)).toBe("3.5s"); });
+  it("minutes", () => { expect(formatDuration(125000)).toBe("2m 5s"); });
+});
+
+describe("isNewer", () => {
+  it("major bump", () => { expect(isNewer("1.0.0", "2.0.0")).toBe(true); });
+  it("minor bump", () => { expect(isNewer("1.0.0", "1.1.0")).toBe(true); });
+  it("patch bump", () => { expect(isNewer("1.0.0", "1.0.1")).toBe(true); });
+  it("same version", () => { expect(isNewer("1.0.0", "1.0.0")).toBe(false); });
+  it("older version", () => { expect(isNewer("2.0.0", "1.0.0")).toBe(false); });
+});