feat: Phase 3 — E2EE calls, Jitsi conferencing, help tab, web security model

- LiveKit call E2EE: CallE2EEManager exchanges encryption keys via Matrix
  to-device events (m.rtc.encryption_keys) for interop with Element X
- Olm bootstrapped in index.html before Flutter init; main.dart logs result
- Encrypted messages shown with lock icon and informative fallback text
- Profile screen: key restore dialog + security setup (cross-signing/backup)
- Jitsi feature: welcome screen (public, no login), conference tab, full-screen
  embed via JitsiMeetExternalAPI, JitsiLink parser for all common link formats
- Help tab: expandable cards for encryption, video calls, account management
- Web security model: no session persistence — device ID only across visits
- Media auth: MSC3916 authenticated endpoint for avatars (Synapse 1.120+)
- Router: welcome route as public landing page; jitsi route as public
- Manifest/index.html: M8Chat branding, dark theme colours

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/shared/utils/mxc_url.dart

@@ -1,28 +1,32 @@
-// Version: 1.0.0 | Created: 2026-04-02
+// Version: 2.0.0 | Created: 2026-04-02 | Updated: 2026-04-11
 // Synchronous MXC URI to HTTP URL resolution.
-// Avatars and thumbnails in the room list / sync service need a resolved HTTP
-// URL. The Matrix SDK's getDownloadUri() is async (checks authenticated media
-// support), but for avatar display we need a synchronous result.
 //
-// This helper builds the legacy v3 media URL which works on all homeservers.
+// Synapse 1.120+ requires authenticated media downloads. The old
+// /_matrix/media/v3/download/ endpoint is frozen and returns 404.
+// We use /_matrix/client/v1/media/download/ with the access token.
 
 import 'package:matrix/matrix.dart';
 
-/// Resolves an `mxc://` [Uri] to an HTTP download URL using the client's
-/// homeserver. Returns `null` if the URI is not an mxc scheme or the client
-/// has no homeserver set.
-///
-/// This is synchronous — suitable for use in non-async model mapping.
+/// Resolves an `mxc://` [Uri] to an authenticated HTTP download URL.
+/// Returns `null` if the URI is not mxc:// or the client is not connected.
 String? resolveMxcUrl(Client client, Uri? mxcUri) {
   if (mxcUri == null || !mxcUri.isScheme('mxc')) return null;
   final homeserver = client.homeserver;
   if (homeserver == null) return null;
 
-  // Build the media download path per the Matrix spec.
   final serverName = mxcUri.host;
   final port = mxcUri.hasPort ? ':${mxcUri.port}' : '';
   final mediaId = mxcUri.path; // includes leading /
-  return homeserver
-      .resolve('_matrix/media/v3/download/$serverName$port$mediaId')
+
+  // Use the authenticated media endpoint (MSC3916).
+  final base = homeserver
+      .resolve('_matrix/client/v1/media/download/$serverName$port$mediaId')
       .toString();
+
+  // Append the access token so CachedNetworkImage / Image.network can
+  // fetch without custom headers. The token is already in the browser's
+  // JS memory so this doesn't expand the attack surface.
+  final token = client.accessToken;
+  if (token == null) return base;
+  return '$base?access_token=$token';
 }