me-web? 0.2: the test from outside, calls and games, mail, and what you can host

Phases two and three ship together, because their code grew in the same
files. With consent the app asks the router to open 80, 443 and a high
port for ten minutes (UPnP, NAT-PMP or PCP), and the server, holding a
single-use ticket bound to the caller's own address, connects back and
must get an HMAC only the app can give; the mappings are removed after the
run and remembered until then, so a crash cannot leave one open. Hairpin
is tried from inside. Two STUN servers, the outside one first, tell easy
from hard NAT.

Mail gets port 25 to Gmail and Outlook, the reverse name and five
blocklists through the user's own resolver, network-wide UCEPROTECT
listings counted as a caution. DNS, speed against the server (four at a
time, twelve an hour per address) and the device follow, and six uses
(website, home from outside, files, game server, fediverse, mail) close
the run as possible, possible with a named workaround, or can't tell.

Findings can be shared after reading the exact JSON: a file per submission
under the unit's state directory, ten a day per address, deletable by the
token the app keeps, swept after twelve months; /privacy says all of it in
English and Italian. QR codes lead to the downloads. Every language carries
every string.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

CLAUDE.md

@@ -59,11 +59,11 @@ The Android release key: alias `meweb`, certificate SHA-256
 | Path | What |
 |---|---|
 | `src/MeWeb.Shared` | `Endpoints.cs` (routes and hosts), wire contracts, `MeWebJsonContext`, generated `BuildInfo` |
-| `src/MeWeb.Core` | the checks, no UI: `Net/` (address kinds, local network, TTL route), `Router/` (UPnP IGD, NAT-PMP, PCP, read-only), `Knowledge/` (provider map and profiles), `History/`, `Checks/` (`CheckRunner`, `Verdicts`, `ServerProbe`) |
+| `src/MeWeb.Core` | the checks, no UI: `Net/` (address kinds, local network, TTL route, STUN, the probe's `Answerer`, DNS, speed, the device), `Router/` (UPnP IGD, NAT-PMP, PCP; `PortMapper` opens and removes mappings, `Leftovers` remembers them across a crash), `Mail/` (port 25, reverse name, blocklists through the user's resolver), `Knowledge/` (provider map and profiles), `History/` (checks, shared submissions), `Checks/` (`CheckRunner`, `Verdicts`, `Reach`, `Uses`, `ServerProbe`, `SharePayload`) |
 | `src/MeWeb.App` | Avalonia views and view models, `Services/Localizer.cs` (+ `{s:Tr Key}`), `Strings/<code>.json`, `Resources/Colors.axaml` |
 | `src/MeWeb.Desktop` | desktop head (`meweb` executable), Windows manifest |
 | `src/MeWeb.Android` | Android head (`software.arasaka.meweb`), resources, manifest |
-| `src/MeWeb.Server` | `meweb.arasaka.software`: `/api/info`, `/api/ip`, the download page `/` (en, it) and `/download/{platform}` from the latest Gitea release |
+| `src/MeWeb.Server` | `meweb.arasaka.software`: `/api/info`, `/api/ip`, the download page `/` and `/privacy` (en, it), `/download/{platform}` from the latest Gitea release, the probe (`/api/probe/ticket`, `/api/probe/{id}`) and shared findings (`/api/share`, files under `/var/lib/meweb/shares`, swept after `KeepDays`) |
 | `data/languages.json` | 113 languages: code, autonym, English name, `rtl`, `reviewed` or `draft` |
 | `data/isps/*.json` | provider profiles: AS numbers, and per fact a value, who said it (`basis`), the source URL and the month |
 | `tools/knowledge.cs` | downloads iptoasn's `ip2asn-combined.tsv.gz` (cached in `tools/cache`, 12 h) and writes the brotli table `artifacts/knowledge/ip2asn.bin` (~2 MB), embedded by `MeWeb.Core` when present; `tools/release.cs` runs it before every app build |
@@ -84,6 +84,14 @@ The Android release key: alias `meweb`, certificate SHA-256
   second time: the screenshot tool does the real check and every shot inside one `Dispatch`.
 - **Fluent's `Expander` paints its header from resources** (`ExpanderHeaderBackground`, …), not from `Background`; the
   `Expander.explain` style overrides them in `Style.Resources`.
+- **The probe never trusts the client for a target.** A ticket is bound to the address the server saw, single use,
+  60 s; the run refuses any other caller address, private and CGNAT space, and `Probe:Refuse` (the box's own
+  addresses, so the owner cannot probe himself from home). `Probe__AllowPrivate=true` exists for a local server only.
+- **Ask the outside STUN server first.** When `stun.meweb` is the caller's own public address (the owner's line), the
+  first binding hairpins inside the FRITZ!Box with the port preserved and the next destination reuses that mapping,
+  so the order `stun.nextcloud.com` then `stun.meweb` is what reads a symmetric NAT as hard.
+- **Shared findings are files, not Mongo.** The box's Mongo has auth on and me-web? has no user there; a file per
+  submission under the unit's `StateDirectory`, with only the delete token's SHA-256, needs no credentials.
 - **An address inside right-to-left text reorders around `→`.** `Texts.Isolate` wraps every literal value in U+2068/U+2069.
 
 - **Avalonia 12 Android head:** `[Application] MainApplication : AvaloniaAndroidApplication<App>` plus a non-generic