fix: calls — correct MSC4143 JWT flow + message order

Calls:
- JWT fetch now uses correct MSC4143 flow: get OpenID token from
  Synapse, then POST to /_matrix/livekit/jwt/sfu/get (was using
  GET with Bearer token to wrong path — returned 301→404)
- Error messages now visible for 3 seconds before popping screen
  (was flashing away instantly — user couldn't see failure reason)
- Voice vs video calls differentiated via ?video=0/1 query param
- Debug logging added to JWT flow for troubleshooting

Messages:
- Chat timeline now shows newest at bottom (standard behaviour).
  Was reversed twice: SDK returns newest-first, code reversed to
  oldest-first, then ListView(reverse:true) put oldest at bottom.
  Removed the extra .reversed — newest-first + reverse:true = correct.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/features/calls/data/livekit_service.dart

@@ -1,4 +1,4 @@
-// Version: 1.2.0 | Created: 2026-04-01 | Updated: 2026-04-02
+// Version: 1.2.1 | Created: 2026-04-01 | Updated: 2026-04-03
 // LiveKitService — fetches a JWT from the Matrix server's /_matrix/livekit/jwt
 // endpoint, then connects a LiveKit Room using that token.
 //
@@ -8,13 +8,16 @@
 
 import 'dart:convert';
 
+import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
 import 'package:livekit_client/livekit_client.dart';
+import 'package:matrix/matrix.dart' show Client;
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 
 import '../../../core/auth/auth_notifier.dart';
 import '../../../core/auth/auth_state.dart';
 import '../../../core/config/app_config.dart';
+import '../../../core/network/matrix_client.dart';
 
 part 'livekit_service.g.dart';
 
@@ -68,18 +71,21 @@ class LiveKitService {
   /// 2. Use returned token + LiveKit WS URL to connect a [Room]
   Future<LiveKitResult> connect(String matrixRoomId) async {
     final auth = _ref.read(authProvider);
+    debugPrint('[LiveKit] Auth state: ${auth.runtimeType}');
     if (auth is! AuthAuthenticated) {
+      debugPrint('[LiveKit] Not authenticated — cannot fetch JWT');
       return const LiveKitFailed(LiveKitNotAuthenticated());
     }
 
-    final accessToken = auth.accessToken;
     final userId = auth.userId;
+    debugPrint('[LiveKit] Fetching JWT for room=$matrixRoomId user=$userId');
 
-    // Step 1 — fetch JWT from Matrix server
+    // Step 1 — get OpenID token from Synapse (proves our identity)
+    final client = _ref.read(matrixClientProvider);
     final jwtResult = await _fetchJwt(
-      accessToken: accessToken,
-      matrixRoomId: matrixRoomId,
+      client: client,
       userId: userId,
+      matrixRoomId: matrixRoomId,
     );
     if (jwtResult is _JwtError) {
       return LiveKitFailed(LiveKitJwtFetchFailed(jwtResult.message));
@@ -110,39 +116,57 @@ class LiveKitService {
     }
   }
 
+  /// Fetches a LiveKit JWT via the MSC4143 flow:
+  /// 1. Request OpenID token from Synapse (proves our identity)
+  /// 2. POST it to /_matrix/livekit/jwt/sfu/get with the room ID
+  /// 3. Server verifies OpenID token with Synapse and returns LiveKit JWT + URL
   Future<_JwtFetchResult> _fetchJwt({
-    required String accessToken,
-    required String matrixRoomId,
+    required Client client,
     required String userId,
+    required String matrixRoomId,
   }) async {
-    final uri = Uri.parse(
-      AppConfig.livekitJwtUrl,
-    ).replace(queryParameters: {'roomId': matrixRoomId, 'userId': userId});
-
     try {
-      final response = await http.get(
+      // Step 1: Get OpenID token from Synapse
+      debugPrint('[LiveKit] Requesting OpenID token from Synapse...');
+      final openId = await client.requestOpenIdToken(userId, {});
+      debugPrint('[LiveKit] OpenID token received');
+
+      // Step 2: POST to the LiveKit JWT endpoint
+      // The nginx location on matrix.m8chat.au expects /sfu/get sub-path
+      final uri = Uri.parse('${AppConfig.livekitJwtUrl}/sfu/get');
+      debugPrint('[LiveKit] POSTing to $uri');
+
+      final response = await http.post(
         uri,
-        headers: {'Authorization': 'Bearer $accessToken'},
+        headers: {'Content-Type': 'application/json'},
+        body: jsonEncode({
+          'room': matrixRoomId,
+          'openid_token': openId.toJson(),
+        }),
       );
 
+      debugPrint('[LiveKit] JWT response: ${response.statusCode}');
       if (response.statusCode != 200) {
+        debugPrint('[LiveKit] JWT body: ${response.body}');
         return _JwtError(
           'JWT endpoint returned ${response.statusCode}: ${response.body}',
         );
       }
 
       final json = jsonDecode(response.body) as Map<String, dynamic>;
-      // The server returns { token: "...", url: "wss://..." } per MSC4143.
       final token = json['token'] as String?;
       final url = json['url'] as String?;
 
       if (token == null || url == null) {
+        debugPrint('[LiveKit] Response fields: ${json.keys.toList()}');
         return _JwtError('JWT response missing token or url fields.');
       }
 
+      debugPrint('[LiveKit] JWT obtained, LiveKit URL: $url');
       return _JwtOk(token: token, url: url);
     } on Exception catch (e) {
-      return _JwtError('Network error fetching JWT: $e');
+      debugPrint('[LiveKit] Error: $e');
+      return _JwtError('Failed to get call token: $e');
     }
   }
 }