feat: Phase 3 — E2EE calls, Jitsi conferencing, help tab, web security model

- LiveKit call E2EE: CallE2EEManager exchanges encryption keys via Matrix
  to-device events (m.rtc.encryption_keys) for interop with Element X
- Olm bootstrapped in index.html before Flutter init; main.dart logs result
- Encrypted messages shown with lock icon and informative fallback text
- Profile screen: key restore dialog + security setup (cross-signing/backup)
- Jitsi feature: welcome screen (public, no login), conference tab, full-screen
  embed via JitsiMeetExternalAPI, JitsiLink parser for all common link formats
- Help tab: expandable cards for encryption, video calls, account management
- Web security model: no session persistence — device ID only across visits
- Media auth: MSC3916 authenticated endpoint for avatars (Synapse 1.120+)
- Router: welcome route as public landing page; jitsi route as public
- Manifest/index.html: M8Chat branding, dark theme colours

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/app/router.dart

@@ -1,4 +1,4 @@
-// Version: 1.0.2 | Created: 2026-04-01
+// Version: 1.1.0 | Created: 2026-04-01 | Updated: 2026-04-05
 // All route definitions in one place.
 // GoRouter is created ONCE (keepAlive) and re-evaluates redirects via
 // refreshListenable — avoids the GoRouter recreation bug from ref.watch.
@@ -12,6 +12,8 @@ import '../core/auth/auth_state.dart';
 import '../features/auth/presentation/login_screen.dart';
 import '../features/calls/presentation/call_screen.dart';
 import '../features/chat/presentation/chat_screen.dart';
+import '../features/jitsi/presentation/jitsi_screen.dart';
+import '../features/jitsi/presentation/welcome_screen.dart';
 import '../features/profile/presentation/profile_screen.dart';
 import '../features/rooms/presentation/rooms_screen.dart';
 import '../features/spaces/presentation/spaces_screen.dart';
@@ -21,12 +23,14 @@ part 'router.g.dart';
 /// Route path constants — use these instead of raw strings.
 abstract final class AppRoutes {
   static const String root = '/';
+  static const String welcome = '/welcome';
   static const String login = '/login';
   static const String rooms = '/rooms';
   static const String chat = '/rooms/:roomId';
   static const String call = '/calls/:roomId';
   static const String profile = '/profile';
   static const String spaces = '/spaces';
+  static const String jitsi = '/jitsi';
 }
 
 /// ChangeNotifier that GoRouter listens to for redirect re-evaluation.
@@ -35,6 +39,13 @@ class _AuthRefreshNotifier extends ChangeNotifier {
   void notify() => notifyListeners();
 }
 
+/// Routes that are accessible without authentication.
+const _publicRoutes = {
+  AppRoutes.welcome,
+  AppRoutes.login,
+  AppRoutes.jitsi,
+};
+
 @Riverpod(keepAlive: true)
 GoRouter router(Ref ref) {
   // Create once — notifier triggers re-redirect without recreating the router.
@@ -50,16 +61,22 @@ GoRouter router(Ref ref) {
       // Read (not watch) so redirect does not itself trigger provider changes.
       final authState = ref.read(authProvider);
       final isLoggedIn = authState is AuthAuthenticated;
-      final isOnLogin = state.matchedLocation == AppRoutes.login;
+      final currentPath = state.matchedLocation;
+      final isPublicRoute = _publicRoutes.contains(currentPath);
 
       // While restoring session, stay on splash.
       if (authState is AuthInitial || authState is AuthLoading) return null;
 
-      // Unauthenticated users must go to login.
-      if (!isLoggedIn && !isOnLogin) return AppRoutes.login;
+      // Unauthenticated users hitting a protected route → welcome screen.
+      if (!isLoggedIn && !isPublicRoute) return AppRoutes.welcome;
 
-      // Authenticated users should not see the login screen.
-      if (isLoggedIn && isOnLogin) return AppRoutes.rooms;
+      // Authenticated users on welcome or login → go straight to rooms.
+      if (isLoggedIn &&
+          (currentPath == AppRoutes.welcome ||
+              currentPath == AppRoutes.login ||
+              currentPath == AppRoutes.root)) {
+        return AppRoutes.rooms;
+      }
 
       return null;
     },
@@ -68,6 +85,10 @@ GoRouter router(Ref ref) {
         path: AppRoutes.root,
         builder: (context, state) => const _SplashRedirectPage(),
       ),
+      GoRoute(
+        path: AppRoutes.welcome,
+        builder: (context, state) => const WelcomeScreen(),
+      ),
       GoRoute(
         path: AppRoutes.login,
         builder: (context, state) => const LoginScreen(),
@@ -100,6 +121,13 @@ GoRouter router(Ref ref) {
         path: AppRoutes.spaces,
         builder: (context, state) => const SpacesScreen(),
       ),
+      GoRoute(
+        path: AppRoutes.jitsi,
+        builder: (context, state) {
+          final meetingUrl = state.extra as String? ?? '';
+          return JitsiScreen(meetingUrl: meetingUrl);
+        },
+      ),
     ],
   );
 }