fix: security hardening and Safari stability

- Remove hardcoded JWT_SECRET fallback (crash on boot if unset)
- Make LiveKit config optional with 503 guard on token endpoint
- Add REST rate limiting via @fastify/rate-limit (auth 10/15m, messages 5/5s, uploads 10/1m, global 60/1m)
- Add WebSocket token bucket rate limiter (30 burst, 2/sec refill)
- Add DM channel ownership (ownerId) with migration, enforce on add-member
- Require friendship to add users to group DMs
- Add silent 20Hz oscillator to prevent Safari AudioContext suspension
- Move WebSocket heartbeat to Web Worker to bypass Safari background throttling

packages/server/package.json

@@ -12,17 +12,18 @@
   "dependencies": {
     "@fastify/cors": "^9.0.1",
     "@fastify/multipart": "^8.3.0",
+    "@fastify/rate-limit": "^9.1.0",
     "@fastify/static": "^7.0.4",
     "@fastify/websocket": "^10.0.1",
     "@opencord/shared": "workspace:*",
     "bcryptjs": "^2.4.3",
     "better-sqlite3": "^11.3.0",
+    "cheerio": "^1.0.0",
     "dotenv": "^16.4.5",
     "drizzle-orm": "^0.33.0",
     "fastify": "^4.28.1",
     "jsonwebtoken": "^9.0.2",
-    "livekit-server-sdk": "^2.6.1",
-    "cheerio": "^1.0.0"
+    "livekit-server-sdk": "^2.6.1"
   },
   "devDependencies": {
     "@types/bcryptjs": "^2.4.6",