Android CI build + delete-chat (self-only) + SFU copy refresh

- codemagic.yaml: add an Android workflow that builds an installable debug
  APK (Linux instance, no signing needed to test) — the Android equivalent of
  the iOS TestFlight loop. mobile/scripts/android-patch.js injects the
  camera/mic/notification permissions into the CI-generated manifest (android/
  is gitignored, same as ios/).
- Delete chat (self-only): new POST /api/messages/clear bulk-hides a whole DM
  (or group) for the requester via the existing per-user message_hidden
  mechanism — the other party keeps their copy entirely. "Delete chat" button
  added to the DM contact-info panel; chat-cleared synced to my other devices.
  Verified end-to-end on Postgres (A clears -> empty for A, B untouched).
- Meetings copy: SFU is live, so drop the "coming soon" / "small group (mesh)"
  wording on the welcome card and the Meetings header.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

mobile/scripts/android-patch.js

@@ -0,0 +1,43 @@
+// Inject the runtime permissions the web UI needs into the Capacitor-generated AndroidManifest.xml.
+// Run on Codemagic from the Android workflow:
+//   node mobile/scripts/android-patch.js mobile/android/app/src/main/AndroidManifest.xml
+//
+// WHY: mobile/android/ is gitignored (regenerated in CI by `cap add android`, same as iOS ios/). The
+// freshly generated manifest only declares INTERNET, so without this the WebRTC calls in the web UI can't
+// get camera/mic and Android 13+ never prompts for notifications. This adds the same permissions listed in
+// mobile/resources/android-permissions.xml. (When the native-call Android plugin lands, it will contribute
+// its own manifest entries via Capacitor manifest-merging; this only covers the app-level WebView perms.)
+//
+// TOLERANT: exits 0 and no-ops if anything is off, so it can NEVER fail the build. Idempotent (keyed on
+// the bzcAndroidPerms marker), so re-runs never duplicate the block.
+const fs = require('fs');
+const p = process.argv[2];
+if (!p || !fs.existsSync(p)) { console.log('  (AndroidManifest.xml not found — permission patch skipped)'); process.exit(0); }
+try {
+  let s = fs.readFileSync(p, 'utf8');
+  if (s.includes('bzcAndroidPerms') || s.includes('android.permission.RECORD_AUDIO')) {
+    console.log('  Android permissions already present'); process.exit(0);
+  }
+  const block = [
+    '',
+    '    <!-- bzcAndroidPerms: permissions the Biz Connect web UI needs (see mobile/resources/android-permissions.xml) -->',
+    '    <!-- Push notifications: Android 13 (API 33)+ shows a runtime prompt -->',
+    '    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />',
+    '    <!-- Voice / video calls + camera, used by the WebRTC features in the web UI -->',
+    '    <uses-permission android:name="android.permission.CAMERA" />',
+    '    <uses-permission android:name="android.permission.RECORD_AUDIO" />',
+    '    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" />',
+    '    <!-- Camera is optional hardware (tablets without one can still install) -->',
+    '    <uses-feature android:name="android.hardware.camera" android:required="false" />',
+    '',
+  ].join('\n');
+  const orig = s;
+  // Insert directly before the closing </manifest> tag.
+  s = s.replace(/<\/manifest>\s*$/, block + '</manifest>\n');
+  if (s === orig) { console.log('  could not find </manifest> — permission patch skipped'); process.exit(0); }
+  fs.writeFileSync(p, s);
+  console.log('  Android permissions injected into ' + p);
+} catch (e) {
+  console.log('  Android permission patch skipped:', e.message);
+}
+process.exit(0);