Add end-to-end encrypted voice messages; release v5.4.5

- Record voice notes in-browser, sent over the chunked AES-GCM file-transfer
  channel (per-file session key + signed SHA-256 integrity).
- Captured as PCM and encoded to WAV for universal playback (incl. iOS/Safari);
  auto-accepted and played inline from an in-memory blob, never written to disk.
- Composer mic button with live waveform + timer; desktop shows mic + send side
  by side, mobile swaps mic to send when typing.
- CSP media-src now allows blob: so recorded/received audio can play.
- Roadmap: Desktop Edition -> 5.0, new 5.5 'Secure Voice & Calls', later
  milestones shifted; version bumped to 5.4.5.
- Update README, docs (security/API/cryptography), and CHANGELOG.

src/scripts/load-async-css.js

@@ -0,0 +1,21 @@
+// Loads non-render-critical stylesheets asynchronously so they don't block first
+// paint. This runs from a deferred <script> (after the document is parsed), and only
+// appends <link rel="stylesheet"> elements — no inline event handlers — so it stays
+// within the page CSP (script-src 'self', style-src 'self' 'unsafe-inline').
+//
+// Deferred here (decorative / non-layout, not needed for the initial paint):
+//   - FontAwesome (~102KB): icon glyphs. Their webfonts are still <link rel=preload>ed
+//     in index.html, so they download in parallel and apply as soon as this CSS lands.
+//   - Prism (tiny): syntax-highlighting theme, only used inside code blocks in chat.
+(function () {
+  var sheets = [
+    '/assets/fontawesome/css/all.min.css',
+    '/libs/prism/prism.css'
+  ];
+  for (var i = 0; i < sheets.length; i++) {
+    var link = document.createElement('link');
+    link.rel = 'stylesheet';
+    link.href = sheets[i];
+    document.head.appendChild(link);
+  }
+})();