feat(meetings): LiveKit SFU — phase 1 (server plumbing, config-gated)

Adds the server side of scaling meetings past the ~5-peer mesh:
- config.js: LIVEKIT_URL/API_KEY/API_SECRET + LIVEKIT_ENABLED flag. All optional;
  when unset the app keeps the built-in P2P mesh (fully additive, like push).
- routes.js: GET /api/meetings/config (tells the client sfu on/off + wss url) and
  POST /api/meetings/token (mints a per-user, per-room LiveKit join token — hand-rolled
  HS256 JWT like the FCM/APNs tokens, no new dependency; secret stays server-side).
- docker-compose.yml: optional livekit service (single-node, no Redis), keys injected
  via LIVEKIT_KEYS from the same .env; media over published UDP 50000-50100 + TCP 7881,
  signaling proxied by NPM.
- livekit.yaml + .env.example documented.

Client (mesh->LiveKit media swap, behind the flag) lands in phase 2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

livekit.yaml

@@ -0,0 +1,21 @@
+# LiveKit SFU config (non-secret — the API key/secret are injected via the LIVEKIT_KEYS env var
+# in docker-compose, sourced from .env, so nothing secret lives in git).
+#
+# Media plane: LiveKit needs UDP reachable from clients (NPM only proxies the HTTP/WS signaling on
+# 7880). The UDP range + TCP fallback below are published as HOST ports in docker-compose. On the
+# VPS, if the server sits behind NAT and can't auto-detect its public IP, set rtc.node_ip to it.
+port: 7880                     # signaling (HTTP/WS) — NPM proxies wss://livekit.bizgaze.com -> here
+rtc:
+  tcp_port: 7881               # WebRTC-over-TCP fallback (restrictive networks)
+  port_range_start: 50000      # WebRTC media (UDP) — keep in sync with the published range in compose
+  port_range_end: 50100
+  use_external_ip: true        # discover the public IP for ICE candidates (VPS). Or set node_ip below.
+  # node_ip: 118.95.33.89      # uncomment + set if use_external_ip can't detect the public IP
+
+# Embedded TURN over TLS on 443 helps clients on locked-down networks. Left off by default because
+# NPM already owns 443; enable via a dedicated hostname + NPM stream if you need it (see DEPLOY.md).
+turn:
+  enabled: false
+
+logging:
+  level: info