knoten serve: a remote graph friends can be invited to

[BY571]

Phase 1 of the remote-graphs design: transport. A graph can be created on a
knoten serve server, a friend invited with read or write rights, and both can
push and pull through the rule gate over HTTP.

# you, once, in your graph
knoten remote create trading --on https://graphs.example
knoten invite maria --role write        # prints a one-time code

# maria, anywhere
knoten join https://graphs.example/trading --invite 7f3a9c...
knoten frontier                         # her clone; the loop is unchanged from here
knoten push                             # over HTTPS, through the gate

What it is

The server is the standard library in front of git http-backend, which ships
with git. Its one job per request is to decide whether this token may do this;
packfiles, refs, negotiation and the pre-receive gate are git's. git's own
protocol already separates reading from writing by endpoint, so a read token
is one that never gets past the door for git-receive-pack.

State is three hashed JSON files per graph (tokens, invites) plus one owner
secret, under the same flock the graph uses locally. Nothing in them is needed
to interpret a graph: losing the server loses availability, not meaning.

What was found in review, and fixed

Every task was reviewed by a fresh agent; a final whole-branch review ran on
the most capable model. Things that were wrong in the plan and are right now:

• create() rolls back a half-made repo; a graph that exists() but has no gate
  would have accepted pushes forever.
• A crashed git http-backend is a 500, not a silent 200.
• Non-object JSON, non-numeric days, a malformed or negative Content-Length,
  and chunked bodies are refusals, not tracebacks or a parked thread.
• --bind is parsed and the socket bound before the owner secret is written,
  so a typo cannot orphan the secret unseen.
• The credentials file is fchmoded 0600 on every write, not just on creation.
• Secrets that travel on a command line (--owner-secret, --invite) are hex,
  because token_urlsafe can start with - and argparse then reads it as a flag.
• _explain matches git's phrasing, not bare digits: the ephemeral port was
  flipping 401/403 verdicts, which was the intermittent test.
• /join answers an unknown graph exactly as it answers a wrong code.
• join says the invite is spent and credentials are saved when a clone fails
  after redemption.

Testing

Real git against a real knoten serve on a random port throughout; the only
fakes are a crashed backend (real git cannot be made to crash headerless on
demand), a stubbed getpass prompt, and serve_forever in three CLI tests.
398 passed, no warnings.

Not in this PR, by design

Signed commits, contributors in graph.yaml, and the verification quorum are
phases 2 and 3 of the same spec. Parked with rulings for the next phase: a
timing difference on /join between unknown-graph and wrong-code refusals
(identical bodies, localhost-bound behind a proxy), and _admin answering 403
where a missing token could be 401.

Base is share/server-gate (#32) so this diff is phase 1 alone; retarget to
master once #32 merges.

🤖 Generated with Claude Code

https://claude.ai/code/session_013cJ97A5dq8ww3d7qoDfYxb