feat: Phase 3 — E2EE calls, Jitsi conferencing, help tab, web security model

- LiveKit call E2EE: CallE2EEManager exchanges encryption keys via Matrix
  to-device events (m.rtc.encryption_keys) for interop with Element X
- Olm bootstrapped in index.html before Flutter init; main.dart logs result
- Encrypted messages shown with lock icon and informative fallback text
- Profile screen: key restore dialog + security setup (cross-signing/backup)
- Jitsi feature: welcome screen (public, no login), conference tab, full-screen
  embed via JitsiMeetExternalAPI, JitsiLink parser for all common link formats
- Help tab: expandable cards for encryption, video calls, account management
- Web security model: no session persistence — device ID only across visits
- Media auth: MSC3916 authenticated endpoint for avatars (Synapse 1.120+)
- Router: welcome route as public landing page; jitsi route as public
- Manifest/index.html: M8Chat branding, dark theme colours

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/features/auth/data/auth_repository.dart

@@ -1,7 +1,8 @@
-// Version: 1.1.0 | Created: 2026-04-01 | Updated: 2026-04-02
+// Version: 2.0.0 | Created: 2026-04-01 | Updated: 2026-04-11
 // Auth repository: handles all Matrix login/logout API interactions.
 // Uses the Matrix Dart SDK — no raw HTTP calls for auth.
 
+import 'package:flutter/foundation.dart';
 import 'package:matrix/matrix.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 
@@ -34,15 +35,16 @@ class AuthRepository {
     required String password,
   }) async {
     try {
-      // Set homeserver directly — avoids network round-trips and version checks
-      // that checkHomeserver() makes. The setter is public in matrix 0.33.0.
       _client.homeserver = Uri.parse(AppConfig.matrixBaseUrl);
-      return await _client.login(
+      final response = await _client.login(
         LoginType.mLoginPassword,
         identifier: AuthenticationUserIdentifier(user: username),
         password: password,
         initialDeviceDisplayName: AppConfig.appName,
       );
+      debugPrint('[M8Chat] Login complete. encryptionEnabled=${_client.encryptionEnabled}');
+      debugPrint('[M8Chat] encryption=${_client.encryption}');
+      return response;
     } on MatrixException catch (e) {
       throw switch (e.errcode) {
         'M_FORBIDDEN' => const AuthFailure.invalidCredentials(),
@@ -77,19 +79,5 @@ class AuthRepository {
     }
   }
 
-  /// Restores an existing Matrix session using a stored access token.
-  Future<void> restoreSession({
-    required String accessToken,
-    required String userId,
-    required String deviceId,
-  }) async {
-    await _client.init(
-      newToken: accessToken,
-      newUserID: userId,
-      newDeviceID: deviceId,
-      newDeviceName: AppConfig.appName,
-      newHomeserver: Uri.parse(AppConfig.matrixBaseUrl),
-      newOlmAccount: null,
-    );
-  }
+  // restoreSession() removed — web app requires fresh login every visit.
 }