feat(G1.5+G1.6): fs-node-server + fsn node command

G1.5 — Node Grundstruktur (fs-node-server crate):
  - NodeLayer trait: start/stop/name lifecycle fuer alle Schichten
  - AuthGateway: OAuthProvider + PamProvider + SsoProvider (fs-auth Traits)
  - S3Provider: StorageLayer wrapping fs-s3 (opendal)
  - ServiceProxy: Capability-Lookup via fs-registry
  - FederationGate: Trait + disabled placeholder (bis Phase P)
  - NodeServer: komposes alle Layers, startet axum HTTP API

G1.6 — Einladungs-System:
  - InviteToken: fsn1. HMAC-signierter Token (node_id|address|expires|nonce)
  - InviteBundle: age-verschluesseltes TOML-Paket (passphrase-basiert)
  - PortPool: port-per-invitation Allokation aus konfigurierbarem Range
  - InviteSystem: create / verify / accept

CLI-Integration (fsn node):
  - fsn node serve  -- startet NodeServer
  - fsn node invite create  -- generiert Token + verschluesseltes Bundle
  - fsn node invite accept  -- nimmt Einladung an

Author: FreeSynergy

cli/Cargo.lock

@@ -11,6 +11,7 @@ members = [
     "crates/fs-container",
     "crates/fs-builder",
     "crates/fs-template",
+    "crates/fs-node-server",
 ]
 resolver = "2"
 
@@ -40,8 +41,10 @@ fs-help      = { path = "../../fs-help" }
 fs-pkg            = { path = "../../fs-packages/fs-pkg" }
 fs-plugin-sdk     = { path = "../../fs-packages/fs-plugin-sdk" }
 fs-plugin-runtime = { path = "../../fs-packages/fs-plugin-runtime" }
+fs-registry   = { path = "../../fs-registry" }
 # Internal crates
-fs-node-core = { path = "crates/fs-node-core" }
+fs-node-core   = { path = "crates/fs-node-core" }
+fs-node-server = { path = "crates/fs-node-server" }
 fs-deploy    = { path = "crates/fs-deploy" }
 fs-dns       = { path = "crates/fs-dns" }
 fs-host      = { path = "crates/fs-host" }

cli/Cargo.toml

@@ -36,7 +36,11 @@ tower-http     = { workspace = true }
 serde_json     = { workspace = true }
 reqwest        = { workspace = true }
 uuid           = { workspace = true }
-fs-pkg        = { workspace = true }
+fs-pkg         = { workspace = true }
+fs-registry    = { workspace = true }
+fs-node-server = { workspace = true }
+fs-auth        = { workspace = true }
+async-trait    = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }

cli/crates/fs-node-cli/Cargo.toml

@@ -195,6 +195,12 @@ pub enum Command {
         cmd: BusCommand,
     },
 
+    /// Node server management (orchestration layers + invite system)
+    Node {
+        #[command(subcommand)]
+        cmd: NodeCommand,
+    },
+
     /// Show system information (OS, features, disk, memory, CPU temperature)
     Sysinfo {
         /// Show live on-demand data (disk, memory, temperature) instead of cached static info
@@ -568,6 +574,61 @@ pub enum ConfigCommand {
     },
 }
 
+#[derive(Subcommand)]
+pub enum NodeCommand {
+    /// Start the full Node server (Auth, S3, `ServiceProxy`, Federation, API)
+    Serve {
+        /// HTTP bind address
+        #[arg(long, default_value = "127.0.0.1")]
+        bind: String,
+
+        /// HTTP port for the Node API
+        #[arg(long, default_value = "8080")]
+        port: u16,
+
+        /// Public domain name of this node (e.g. "node.example.com")
+        #[arg(long)]
+        domain: Option<String>,
+    },
+
+    /// Node invitation management
+    Invite {
+        #[command(subcommand)]
+        cmd: InviteCommand,
+    },
+}
+
+#[derive(Subcommand)]
+pub enum InviteCommand {
+    /// Generate a new invite token and encrypted bundle
+    Create {
+        /// Token lifetime in hours (default: 24)
+        #[arg(long, default_value = "24")]
+        ttl_hours: u64,
+
+        /// Optional label for this invite (e.g. recipient name)
+        #[arg(long)]
+        label: Option<String>,
+
+        /// First port in the invite port range
+        #[arg(long, default_value = "9100")]
+        port_min: u16,
+
+        /// Last port (exclusive) in the invite port range
+        #[arg(long, default_value = "9200")]
+        port_max: u16,
+    },
+
+    /// Accept an invite from another node (decrypt bundle + connect)
+    Accept {
+        /// The invite token string
+        token: String,
+
+        /// The encrypted bundle string
+        bundle: String,
+    },
+}
+
 #[derive(Subcommand)]
 pub enum InstallRootCommand {
     /// Show all current installation base paths
@@ -801,6 +862,7 @@ pub async fn run() -> Result<()> {
                 payload,
             } => commands::bus::publish_event(&topic, &source, payload.as_deref()).await,
         },
+        Command::Node { cmd } => commands::node::run(&root, cmd).await,
         Command::Sysinfo {
             live,
             refresh,

cli/crates/fs-node-cli/src/cli.rs

@@ -9,6 +9,7 @@ pub mod init;
 pub mod install;
 pub mod install_root;
 pub mod logs;
+pub mod node;
 pub mod remove;
 pub mod restart;
 pub mod serve;