feat(calls): CallKit kill-switch + fix ~1s re-ring on cancel

MIC BROKEN with CallKit: a CallKit call reserves the microphone, so the WebView's
WebRTC can't capture it — calls are unusable until native LiveKit media lands. Add a
server kill-switch (CALLKIT_ENABLED, default OFF) so CallKit can be flipped without an
app rebuild: /api/meetings/config now returns callkit; setupNativeCall bails when off
(-> WebView calls, mic works); push.js only sends VoIP/CallKit pushes when enabled.
Deploying with the flag unset immediately restores working WebView calls.

RE-RING: a late cancel push for an already-declined call hit the plugin's 'unknown
uuid' path and re-reported a fresh incoming call (~1s re-ring). Track endedCalls and
make a late cancel for an already-ended call a no-op.

Server part deploys now (no rebuild); plugin re-ring fix ships with the native build.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/config.js

@@ -42,6 +42,12 @@ const PUBLIC_BASE_URL = (process.env.PUBLIC_BASE_URL || 'https://remote.bizgaze.
 // calls our /api/gifs proxy. GIF picker is hidden when this isn't configured.
 const GIPHY_API_KEY = process.env.GIPHY_API_KEY || '';
 
+// Native CallKit / PushKit VoIP calling (iOS). Config-gated so it can be flipped WITHOUT an app rebuild:
+// OFF (default) → calls use the WebView flow (works today); ON → iOS rings via CallKit + a VoIP push.
+// Only turn ON once native LiveKit media carries the call audio — a CallKit call reserves the mic, so the
+// WebView's WebRTC can't capture it (mic dead). Set CALLKIT_ENABLED=1 in the server .env to enable.
+const CALLKIT_ENABLED = process.env.CALLKIT_ENABLED === '1';
+
 module.exports = {
   PORT: process.env.PORT || 8090,
   HTTPS_PORT: process.env.HTTPS_PORT || 8443,
@@ -58,6 +64,7 @@ module.exports = {
   SMTP_ENABLED,
   PUBLIC_BASE_URL,
   GIPHY_API_KEY,
+  CALLKIT_ENABLED,
   PUBLIC_DIR,
   REC_DIR,
   TRANS_DIR,