[MeshCore] Outbound 2FA claim: WS dispatch + HTTP verify

[pskillen]

Parent (UI user flow)

Part of meshflow-ui#291 — Claim MeshCore node / feeder onboarding epic.

Repo	Issue
UI	meshflow-ui#303
Bot	meshflow-bot#120

Meshtastic inbound DM claim stays unchanged (node-claims-meshtastic.md).

Replaces the fragile inbound MeshCore flow in node-claims-meshcore.md. Basic MC claim shipped in meshflow-ui#292 (closed).

Problem

MeshCore DMs require the recipient in the radio contact list (usually populated via RF adverts). Users claiming from the web UI cannot reliably DM a feeder with the claim key. The API already knows the target node's mc_pubkey / prefix from telemetry; a feeder should DM the user with the code; the user types the code back in the UI.

Architecture

sequenceDiagram
  participant UI as meshflow-ui
  participant API as meshflow-api
  participant WS as ws/nodes (feeder)
  participant Bot as meshflow-bot (MC)
  participant Radio as MeshCore device

  UI->>API: POST observed-nodes/{id}/claim/ (existing)
  API->>API: Create NodeOwnerClaim + claim_key
  API->>WS: node_command send_mc_claim_dm
  WS->>Bot: command JSON
  Bot->>Radio: add contact + send DM(claim_key)
  Radio->>User: DM with claim key
  UI->>API: POST observed-nodes/{id}/claim/verify/ { claim_key }
  API->>API: Match pending claim, set accepted_at + claimed_by
  API->>UI: node_claim_accepted (HTTP + ws/claims/)

Loading

Scope (meshflow-api)

1. Initiate claim (POST …/claim/)

• For protocol=MESHCORE only: after creating NodeOwnerClaim, resolve target identity (mc_pubkey, fallback mc_pubkey_prefix) from ObservedNode.
• Select feeder ManagedNode (optional feeder_managed_node_id from UI; else eligible connected MC feeder).
• Dispatch via dispatch_node_command (apply_mc_channel_config pattern).

2. WS command send_mc_claim_dm

{
  "type": "send_mc_claim_dm",
  "target_mc_pubkey": "<64-hex or null>",
  "target_mc_pubkey_prefix": "<12-hex or null>",
  "message": "<claim_key>"
}

3. Verify claim (POST …/claim/verify/)

• Body { "claim_key": "…" }; normalize like normalize_claim_key.
• Emit node_claim_authorized + notify_node_claim_accepted.
• Keep inbound try_accept_node_claim on ingest as fallback until outbound is stable.

4. Docs + tests

• Update node-claims-meshcore.md.
• openapi.yaml for verify route.

Depends on

• Bot #120 — MC send + WS (blocker today).
• UI #303.