fix: security hardening and Safari stability

- Remove hardcoded JWT_SECRET fallback (crash on boot if unset)
- Make LiveKit config optional with 503 guard on token endpoint
- Add REST rate limiting via @fastify/rate-limit (auth 10/15m, messages 5/5s, uploads 10/1m, global 60/1m)
- Add WebSocket token bucket rate limiter (30 burst, 2/sec refill)
- Add DM channel ownership (ownerId) with migration, enforce on add-member
- Require friendship to add users to group DMs
- Add silent 20Hz oscillator to prevent Safari AudioContext suspension
- Move WebSocket heartbeat to Web Worker to bypass Safari background throttling

packages/server/src/db/index.ts

@@ -76,6 +76,7 @@ function createTables(db: Database.Database): void {
 
     CREATE TABLE IF NOT EXISTS dm_channels (
       id TEXT PRIMARY KEY,
+      owner_id TEXT,
       created_at INTEGER NOT NULL
     );
 

packages/server/src/db/migrate.ts

@@ -41,6 +41,12 @@ export function runMigrations(db: Database.Database): void {
       columns: [
         { name: 'closed', type: 'INTEGER DEFAULT 0' }
       ]
+    },
+    {
+      name: 'dm_channels',
+      columns: [
+        { name: 'owner_id', type: 'TEXT' }
+      ]
     }
   ];
 

packages/server/src/db/schema.ts

@@ -68,6 +68,7 @@ export const attachments = sqliteTable('attachments', {
 
 export const dmChannels = sqliteTable('dm_channels', {
   id: text('id').primaryKey(),
+  ownerId: text('owner_id'),
   createdAt: integer('created_at').notNull(),
 });