feat(meetings): LiveKit SFU — phase 1 (server plumbing, config-gated)

Adds the server side of scaling meetings past the ~5-peer mesh:
- config.js: LIVEKIT_URL/API_KEY/API_SECRET + LIVEKIT_ENABLED flag. All optional;
  when unset the app keeps the built-in P2P mesh (fully additive, like push).
- routes.js: GET /api/meetings/config (tells the client sfu on/off + wss url) and
  POST /api/meetings/token (mints a per-user, per-room LiveKit join token — hand-rolled
  HS256 JWT like the FCM/APNs tokens, no new dependency; secret stays server-side).
- docker-compose.yml: optional livekit service (single-node, no Redis), keys injected
  via LIVEKIT_KEYS from the same .env; media over published UDP 50000-50100 + TCP 7881,
  signaling proxied by NPM.
- livekit.yaml + .env.example documented.

Client (mesh->LiveKit media swap, behind the flag) lands in phase 2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -25,6 +25,26 @@ services:
     networks:
       - npm
 
+  # LiveKit SFU — meeting media server. Optional: only started/used when the app's .env has
+  # LIVEKIT_URL/API_KEY/API_SECRET set (otherwise meetings use the built-in P2P mesh). NPM proxies
+  # wss://livekit.bizgaze.com -> livekit:7880 (signaling); media flows over the published UDP/TCP
+  # ports below, NOT through NPM. Single-node (no Redis) — consistent with the app's single-instance rule.
+  livekit:
+    image: livekit/livekit-server:v1.7
+    container_name: bizgaze-livekit
+    restart: unless-stopped
+    command: --config /etc/livekit.yaml
+    environment:
+      # key: secret, sourced from the same .env as the app so both sign/verify with the same secret.
+      - "LIVEKIT_KEYS=${LIVEKIT_API_KEY}: ${LIVEKIT_API_SECRET}"
+    volumes:
+      - ./livekit.yaml:/etc/livekit.yaml:ro
+    ports:
+      - "7881:7881"                    # WebRTC over TCP (fallback)
+      - "50000-50100:50000-50100/udp"  # WebRTC media (UDP) — must match livekit.yaml port range
+    networks:
+      - npm
+
 networks:
   npm:
     external: true