Kanidm group-gated rooms and minimal mesh calling

Rooms can now require a Kanidm group (via the `groups` OIDC claim,
mapped by `oauth2 update-claim-map` server-side) - dev/ops require
`developers`, enforced at every message path (send, history, SSE).

Adds a minimal WebRTC mesh call feature scoped to the lobby room,
signaled over a separate `call.room.*` NATS subject kept out of the
chat archive: public STUN only, no TURN, no SFU - small groups on
friendly networks, by design.

Cargo.toml

@@ -29,6 +29,12 @@ sqlx = { version = "0.8", default-features = false, features = [
     "macros",
 ], optional = true }
 openidconnect = { version = "4", optional = true }
+# For pulling the `groups` custom claim out of the already-verified ID
+# token's raw JWT payload - openidconnect's Core* type aliases default to
+# EmptyAdditionalClaims, and reworking that generic stack for one extra
+# field isn't worth it. The token's signature is already checked by
+# id_token.claims(...) before this ever runs.
+base64 = { version = "0.22", optional = true }
 futures = { version = "0.3", optional = true }
 chrono = { version = "0.4", features = ["serde"], optional = true }
 uuid = { version = "1", features = ["v4"], optional = true }
@@ -39,12 +45,33 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"], optional = tr
 
 # --- browser only ---
 wasm-bindgen = { version = "0.2", optional = true }
+wasm-bindgen-futures = { version = "0.4", optional = true }
+js-sys = { version = "0.3", optional = true }
 console_error_panic_hook = { version = "0.1", optional = true }
 web-sys = { version = "0.3", features = [
     "EventSource",
     "MessageEvent",
     "HtmlElement",
     "Element",
+    # --- WebRTC mesh calling ---
+    "RtcPeerConnection",
+    "RtcConfiguration",
+    "RtcIceServer",
+    "RtcSdpType",
+    "RtcSessionDescriptionInit",
+    "RtcIceCandidate",
+    "RtcIceCandidateInit",
+    "RtcPeerConnectionIceEvent",
+    "RtcRtpSender",
+    "RtcTrackEvent",
+    "RtcRtpTransceiver",
+    "RtcOfferOptions",
+    "MediaStream",
+    "MediaStreamConstraints",
+    "MediaStreamTrack",
+    "MediaDevices",
+    "Navigator",
+    "HtmlVideoElement",
 ], optional = true }
 
 [features]
@@ -52,6 +79,8 @@ default = []
 hydrate = [
     "leptos/hydrate",
     "dep:wasm-bindgen",
+    "dep:wasm-bindgen-futures",
+    "dep:js-sys",
     "dep:console_error_panic_hook",
     "dep:web-sys",
 ]
@@ -69,6 +98,7 @@ ssr = [
     "dep:url",
     "dep:sqlx",
     "dep:openidconnect",
+    "dep:base64",
     "dep:futures",
     "dep:chrono",
     "dep:uuid",