feat: user-configurable STUN/TURN servers (advanced network settings)

- add iceServers.js: allowlist-based validation/normalization of user-supplied
  STUN/TURN URLs (rejects javascript:/data:/http/ws, control chars, enforces limits)
- add iceSettingsStore.js: opt-in persistence encrypted at rest with a
  non-extractable AES-GCM device key in IndexedDB; load/save/clear
- add IceServerSettings.jsx modal: public vs custom servers, JSON/line input,
  live validation, relay-only toggle, 'Test servers' connectivity check,
  save-on-device prompt, forget-saved action
- wire chosen servers/privacy mode into EnhancedSecureWebRTCManager construction
  (priority: custom > operator override > built-in defaults)
- entry point on the connection-creation screen next to the relay-only toggle
- add ice-servers-validation.test.mjs to the suite

meta.json

@@ -1,10 +1,10 @@
 {
-  "version": "1781550335673",
-  "buildVersion": "1781550335673",
+  "version": "1781552284668",
+  "buildVersion": "1781552284668",
   "appVersion": "4.8.9",
-  "buildTime": "2026-06-15T19:05:35.714Z",
-  "buildId": "1781550335673-d11f250",
-  "gitHash": "d11f250",
+  "buildTime": "2026-06-15T19:38:04.713Z",
+  "buildId": "1781552284668-366f080",
+  "gitHash": "366f080",
   "generated": true,
-  "generatedAt": "2026-06-15T19:05:35.717Z"
+  "generatedAt": "2026-06-15T19:38:04.715Z"
 }