feat(webrtc): end-to-end encrypted voice & video calls with adaptive codecs

Add 1:1 voice and video calling over the existing SAS-verified peer
connection. Audio and video tracks ride the same RTCPeerConnection as the
chat, bundled onto one DTLS-SRTP transport, so media inherits the session's
end-to-end encryption. SDP offer/answer is renegotiated in-band over the
verified data channel — no signalling server, so the media's DTLS
fingerprints are authenticated end-to-end. Calls are gated on a connected,
SAS-verified session.

Codecs & adaptation:
- Opus tuned for lossy links (in-band FEC, DTX, RED redundancy); audio is
  bandwidth-prioritised and never throttled.
- VP9/AV1 single-encoding SVC with H.264/VP8 fallback; video degrades by
  spatial/temporal layer.
- Runtime NetworkAdaptationController trims video bitrate on loss/RTT and
  recovers as the link clears — no renegotiation. Live connection-quality
  indicator (Excellent/Good/Fair/Weak) in the call UI.

In-call controls: mute, camera on/off (voice→video upgrade in-band),
camera flip, minimize-to-widget, hang up, and accept/decline for incoming
calls. Production logging disabled (DEBUG_MODE=false); temporary call
diagnostic logger removed. Codec rationale in docs/webrtc-config.md.

deploy/nginx.conf

@@ -88,9 +88,9 @@ http {
         # Force HTTPS for two years and preload, closing the first-visit SSL-strip
         # window that upgrade-insecure-requests alone does not cover.
         add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
-        # Lock down powerful features. Camera is allowed for in-page QR scanning;
-        # microphone/geolocation and other sensors are denied outright.
-        add_header Permissions-Policy        "camera=(self), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()" always;
+        # Lock down powerful features. Camera + microphone are allowed for QR
+        # scanning and encrypted voice/video calls; other sensors are denied.
+        add_header Permissions-Policy        "camera=(self), microphone=(self), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()" always;
         add_header Cache-Control            $sb_cache                          always;
         # Edge-cache directive for Cloudflare/CDNs (empty value → header is omitted).
         add_header CDN-Cache-Control        $sb_cdn_cache                      always;