feat: user-configurable STUN/TURN servers (advanced network settings)

- add iceServers.js: allowlist-based validation/normalization of user-supplied
  STUN/TURN URLs (rejects javascript:/data:/http/ws, control chars, enforces limits)
- add iceSettingsStore.js: opt-in persistence encrypted at rest with a
  non-extractable AES-GCM device key in IndexedDB; load/save/clear
- add IceServerSettings.jsx modal: public vs custom servers, JSON/line input,
  live validation, relay-only toggle, 'Test servers' connectivity check,
  save-on-device prompt, forget-saved action
- wire chosen servers/privacy mode into EnhancedSecureWebRTCManager construction
  (priority: custom > operator override > built-in defaults)
- entry point on the connection-creation screen next to the relay-only toggle
- add ice-servers-validation.test.mjs to the suite

src/scripts/app-boot.js

@@ -13,6 +13,7 @@ import '../components/ui/Testimonials.jsx';
 import '../components/ui/ComparisonTable.jsx';
 import '../components/ui/Roadmap.jsx';
 import '../components/ui/FileTransfer.jsx';
+import '../components/ui/IceServerSettings.jsx';
 
 // Expose to global for legacy usage inside app code
 window.EnhancedSecureCryptoUtils = EnhancedSecureCryptoUtils;

src/scripts/bootstrap-modules.js

@@ -36,6 +36,7 @@
       import(`../components/ui/Testimonials.jsx?v=${timestamp}`),
       import(`../components/ui/Roadmap.jsx?v=${timestamp}`),
       import(`../components/ui/FileTransfer.jsx?v=${timestamp}`),
+      import(`../components/ui/IceServerSettings.jsx?v=${timestamp}`),
     ]);
 
     // Components are automatically registered on window by their respective modules