Kanidm group-gated rooms and minimal mesh calling

Rooms can now require a Kanidm group (via the `groups` OIDC claim,
mapped by `oauth2 update-claim-map` server-side) - dev/ops require
`developers`, enforced at every message path (send, history, SSE).

Adds a minimal WebRTC mesh call feature scoped to the lobby room,
signaled over a separate `call.room.*` NATS subject kept out of the
chat archive: public STUN only, no TURN, no SFU - small groups on
friendly networks, by design.

src/lib.rs

@@ -1,10 +1,14 @@
 pub mod app;
 pub mod auth;
+pub mod call;
 pub mod chat;
 
 #[cfg(feature = "ssr")]
 pub mod server;
 
+#[cfg(feature = "hydrate")]
+pub mod webrtc;
+
 #[cfg(feature = "hydrate")]
 #[wasm_bindgen::prelude::wasm_bindgen]
 pub fn hydrate() {