feat(meetings): LiveKit SFU — phase 1 (server plumbing, config-gated)

Adds the server side of scaling meetings past the ~5-peer mesh:
- config.js: LIVEKIT_URL/API_KEY/API_SECRET + LIVEKIT_ENABLED flag. All optional;
  when unset the app keeps the built-in P2P mesh (fully additive, like push).
- routes.js: GET /api/meetings/config (tells the client sfu on/off + wss url) and
  POST /api/meetings/token (mints a per-user, per-room LiveKit join token — hand-rolled
  HS256 JWT like the FCM/APNs tokens, no new dependency; secret stays server-side).
- docker-compose.yml: optional livekit service (single-node, no Redis), keys injected
  via LIVEKIT_KEYS from the same .env; media over published UDP 50000-50100 + TCP 7881,
  signaling proxied by NPM.
- livekit.yaml + .env.example documented.

Client (mesh->LiveKit media swap, behind the flag) lands in phase 2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -21,3 +21,11 @@ TURN_CREDENTIAL=
 
 # Optional: BizGaze webhook endpoint for session events.
 # BIZGAZE_WEBHOOK_URL=
+
+# Optional: LiveKit SFU for meetings (scales past the ~5-peer P2P mesh). Set ALL THREE to enable;
+# leave unset to keep the built-in mesh. The app mints join tokens with the secret (server-side
+# only); the same key/secret feed the livekit container via LIVEKIT_KEYS in docker-compose.
+# Generate a key/secret pair: two random strings, e.g. `openssl rand -hex 16` for each.
+# LIVEKIT_URL=wss://livekit.bizgaze.com
+# LIVEKIT_API_KEY=
+# LIVEKIT_API_SECRET=