Add end-to-end encrypted voice messages; release v5.4.5

- Record voice notes in-browser, sent over the chunked AES-GCM file-transfer
  channel (per-file session key + signed SHA-256 integrity).
- Captured as PCM and encoded to WAV for universal playback (incl. iOS/Safari);
  auto-accepted and played inline from an in-memory blob, never written to disk.
- Composer mic button with live waveform + timer; desktop shows mic + send side
  by side, mobile swaps mic to send when typing.
- CSP media-src now allows blob: so recorded/received audio can play.
- Roadmap: Desktop Edition -> 5.0, new 5.5 'Secure Voice & Calls', later
  milestones shifted; version bumped to 5.4.5.
- Update README, docs (security/API/cryptography), and CHANGELOG.

deploy/nginx.conf

@@ -28,8 +28,13 @@ http {
 
     gzip            on;
     gzip_vary       on;
+    gzip_proxied    any;
+    gzip_comp_level 6;
     gzip_min_length 256;
-    gzip_types      text/plain text/css application/javascript application/json image/svg+xml font/woff2;
+    gzip_types      text/plain text/css text/javascript
+                    application/javascript application/json application/manifest+json
+                    application/ld+json application/wasm
+                    image/svg+xml image/x-icon font/woff2;
 
     # Decide Cache-Control from the request path. Keeping all add_header calls at
     # one level avoids nginx's header-inheritance reset between blocks.
@@ -40,7 +45,28 @@ http {
         ~^/sw\.js$               "no-cache, no-store, must-revalidate";
         ~^/manifest\.json$       "no-cache, no-store, must-revalidate";
         ~^/meta\.json$           "no-cache, no-store, must-revalidate";
-        ~^/dist/                 "no-cache, no-store, must-revalidate";
+        # dist/ bundles are query-versioned (?v=) in index.html. "no-cache" forces
+        # revalidation on every load, but dropping "no-store" lets the browser reuse
+        # the cached copy on a 304 — avoiding a full re-download of the large bundles
+        # (e.g. qr-local.js ~1.2MB) when nothing changed, while still picking up
+        # new releases immediately.
+        ~^/dist/                 "no-cache, must-revalidate";
+    }
+
+    # CDN-Cache-Control is read by Cloudflare (and other CDNs) *independently* of the
+    # browser Cache-Control above, and takes precedence at the edge. We force "no-store"
+    # for the app shell, service worker and version files so a CDN can never serve a
+    # stale meta.json / index.html / sw.js — which would silently break the in-app
+    # update notification. The empty default emits no header (nginx skips empty values),
+    # so immutable hashed assets keep being edge-cached normally for performance.
+    map $uri $sb_cdn_cache {
+        default                  "";
+        ~^/index\.html$          "no-store";
+        ~^/$                     "no-store";
+        ~^/sw\.js$               "no-store";
+        ~^/manifest\.json$       "no-store";
+        ~^/meta\.json$           "no-store";
+        ~^/dist/                 "no-store";
     }
 
     server {
@@ -62,6 +88,8 @@ http {
         # microphone/geolocation and other sensors are denied outright.
         add_header Permissions-Policy        "camera=(self), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()" always;
         add_header Cache-Control            $sb_cache                          always;
+        # Edge-cache directive for Cloudflare/CDNs (empty value → header is omitted).
+        add_header CDN-Cache-Control        $sb_cdn_cache                      always;
         add_header Service-Worker-Allowed   "/"                                always;
 
         # Real asset files must return 404 when missing — never fall back to the