feat: security hardening, DB indexes, token revocation, and input validation

- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap

packages/web/src/hooks/useLiveKit.ts

@@ -387,7 +387,7 @@ export function useLiveKit() {
     }
     
     try {
-      const client = isDm ? getApiForOrigin('') : getApiForOrigin(getChannelOrigin(channelId));
+      const client = getApiForOrigin(getChannelOrigin(channelId));
       const { token, url } = isDm ? await client.livekit.dmToken(channelId) : await client.livekit.token(channelId);
       if (gen !== _connectGeneration) return;
       const newRoom = new Room({ adaptiveStream: true, dynacast: true, publishDefaults: { videoCodec: 'h264', simulcast: true } });