Kanidm group-gated rooms and minimal mesh calling

Rooms can now require a Kanidm group (via the `groups` OIDC claim,
mapped by `oauth2 update-claim-map` server-side) - dev/ops require
`developers`, enforced at every message path (send, history, SSE).

Adds a minimal WebRTC mesh call feature scoped to the lobby room,
signaled over a separate `call.room.*` NATS subject kept out of the
chat archive: public STUN only, no TURN, no SFU - small groups on
friendly networks, by design.

src/auth.rs

@@ -8,6 +8,11 @@ pub struct User {
     pub sub: String,
     pub username: String,
     pub display_name: String,
+    /// Kanidm group membership, from the `groups` OIDC claim (see
+    /// `oauth2 update-claim-map`). Fixed at login time - not re-checked
+    /// live, so a group change only takes effect on the next login.
+    #[serde(default)]
+    pub groups: Vec<String>,
 }
 
 pub const SESSION_USER_KEY: &str = "user";