fix: calls — JWT field name 'jwt' not 'token', CORS dedup on server

- lk-jwt-service returns {jwt: '...', url: '...'} not {token: '...'}
  Now reads both 'jwt' and 'token' fields for compatibility
- Server nginx: added proxy_hide_header to strip upstream CORS headers
  preventing duplicate Access-Control-Allow-Origin (browser rejects)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/features/calls/data/livekit_service.dart

@@ -154,12 +154,13 @@ class LiveKitService {
       }
 
       final json = jsonDecode(response.body) as Map<String, dynamic>;
-      final token = json['token'] as String?;
+      // lk-jwt-service returns 'jwt' (not 'token') per Element spec
+      final token = (json['jwt'] ?? json['token']) as String?;
       final url = json['url'] as String?;
 
       if (token == null || url == null) {
-        debugPrint('[LiveKit] Response fields: ${json.keys.toList()}');
-        return _JwtError('JWT response missing token or url fields.');
+        debugPrint('[LiveKit] Response keys: ${json.keys.toList()}');
+        return _JwtError('JWT response missing jwt or url. Got: ${json.keys}');
       }
 
       debugPrint('[LiveKit] JWT obtained, LiveKit URL: $url');