feat: security hardening, DB indexes, token revocation, and input validation

- SSRF protection: DNS resolution + private IP blocking on metadata fetcher
- Upload security: CSP/X-Frame-Options headers, SVG forced download, nosniff
- Auth hardening: JWT secret min length, password min 8 chars, token revocation via password_changed_at
- Attachment ownership verification before linking to messages
- Message length limit (4000 chars) enforced on client and server
- Asset URL validation on avatar/banner updates
- Federation instance validation (domain regex, origin scheme, length limits)
- DB indexes on all FK columns for query performance
- Migrations: nullable moderator columns, dm_messages reply_to FK constraint
- File cleanup on avatar/banner replacement and space deletion
- Fastify trustProxy, AbortController on fetches, typing map size cap

packages/web/src/styles/globals.css

@@ -348,3 +348,37 @@
 .animate-step-back {
   animation: stepBack 0.25s ease-out;
 }
+
+/* ── Incoming Call Animations ── */
+@keyframes callRipple {
+  0% { transform: translate(-50%, -50%) scale(0.8); opacity: 0.6; }
+  100% { transform: translate(-50%, -50%) scale(1.8); opacity: 0; }
+}
+
+@keyframes callGlow {
+  0%, 100% { box-shadow: 0 0 20px rgba(134, 239, 172, 0.15); }
+  50% { box-shadow: 0 0 30px rgba(134, 239, 172, 0.25); }
+}
+
+@keyframes callButtonGlow {
+  0%, 100% { box-shadow: 0 0 12px rgba(134, 239, 172, 0.15); }
+  50% { box-shadow: 0 0 20px rgba(134, 239, 172, 0.3); }
+}
+
+.animate-call-ripple {
+  animation: callRipple 3s ease-out infinite;
+}
+
+.animate-call-glow {
+  animation: callGlow 3s ease-in-out infinite;
+}
+
+.animate-call-button-glow {
+  animation: callButtonGlow 2s ease-in-out infinite;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .animate-call-ripple,
+  .animate-call-glow,
+  .animate-call-button-glow { animation: none !important; }
+}