feat: Phase 3 — E2EE calls, Jitsi conferencing, help tab, web security model

- LiveKit call E2EE: CallE2EEManager exchanges encryption keys via Matrix
  to-device events (m.rtc.encryption_keys) for interop with Element X
- Olm bootstrapped in index.html before Flutter init; main.dart logs result
- Encrypted messages shown with lock icon and informative fallback text
- Profile screen: key restore dialog + security setup (cross-signing/backup)
- Jitsi feature: welcome screen (public, no login), conference tab, full-screen
  embed via JitsiMeetExternalAPI, JitsiLink parser for all common link formats
- Help tab: expandable cards for encryption, video calls, account management
- Web security model: no session persistence — device ID only across visits
- Media auth: MSC3916 authenticated endpoint for avatars (Synapse 1.120+)
- Router: welcome route as public landing page; jitsi route as public
- Manifest/index.html: M8Chat branding, dark theme colours

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/core/auth/secure_storage.dart

@@ -1,83 +1,30 @@
-// Version: 1.0.0 | Created: 2026-04-01
-// Typed wrapper around flutter_secure_storage.
-// All token read/write operations go through this class — never call
-// flutter_secure_storage directly from feature code.
+// Version: 2.0.0 | Created: 2026-04-01 | Updated: 2026-04-11
+// Minimal storage: only the Matrix device ID is persisted so that
+// encryption keys accumulate on one device across logins.
+// Access tokens are NOT stored — every browser visit requires login.
 
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 
-import '../config/app_config.dart';
-
 part 'secure_storage.g.dart';
 
-/// Provides a configured [SecureStorage] instance.
 @Riverpod(keepAlive: true)
 SecureStorage secureStorage(Ref ref) => const SecureStorage();
 
-/// Typed wrapper around [FlutterSecureStorage].
-///
-/// Uses AES encryption on Android and Keychain on iOS.
-/// On Web, data is stored in localStorage with encryption — acceptable for
-/// access tokens but NOT for E2EE private keys (Phase 2 concern).
 class SecureStorage {
   const SecureStorage();
 
+  static const _kDeviceId = 'm8chat_device_id';
+
   static const FlutterSecureStorage _storage = FlutterSecureStorage(
     aOptions: AndroidOptions(encryptedSharedPreferences: true),
   );
 
-  Future<void> saveCredentials({
-    required String accessToken,
-    required String userId,
-    required String deviceId,
-  }) async {
-    await _storage.write(
-      key: AppConfig.storageKeyAccessToken,
-      value: accessToken,
-    );
-    await _storage.write(key: AppConfig.storageKeyUserId, value: userId);
-    await _storage.write(key: AppConfig.storageKeyDeviceId, value: deviceId);
-    await _storage.write(
-      key: AppConfig.storageKeyHomeserver,
-      value: AppConfig.matrixBaseUrl,
-    );
+  Future<void> saveDeviceId(String deviceId) async {
+    await _storage.write(key: _kDeviceId, value: deviceId);
   }
 
-  Future<StoredCredentials?> loadCredentials() async {
-    final accessToken = await _storage.read(
-      key: AppConfig.storageKeyAccessToken,
-    );
-    final userId = await _storage.read(key: AppConfig.storageKeyUserId);
-    final deviceId = await _storage.read(key: AppConfig.storageKeyDeviceId);
-
-    if (accessToken == null || userId == null || deviceId == null) {
-      return null;
-    }
-
-    return StoredCredentials(
-      accessToken: accessToken,
-      userId: userId,
-      deviceId: deviceId,
-    );
-  }
-
-  Future<void> clearCredentials() async {
-    await _storage.delete(key: AppConfig.storageKeyAccessToken);
-    await _storage.delete(key: AppConfig.storageKeyUserId);
-    await _storage.delete(key: AppConfig.storageKeyDeviceId);
-    await _storage.delete(key: AppConfig.storageKeyHomeserver);
+  Future<String?> loadDeviceId() async {
+    return _storage.read(key: _kDeviceId);
   }
 }
-
-/// Holds the credentials retrieved from secure storage.
-class StoredCredentials {
-  const StoredCredentials({
-    required this.accessToken,
-    required this.userId,
-    required this.deviceId,
-  });
-
-  final String accessToken;
-  final String userId;
-  final String deviceId;
-}