fix: comprehensive client-side session management for federated DM calls

Four fixes addressing the full state management problem:

1. Passive ready handler: no longer auto-connects to LiveKit on
   page refresh. Prevents identity conflicts when the same user
   has multiple sessions fighting for one LiveKit identity slot.
   The user must re-accept to join; state is shown but not acted on.

2. SoundController sync guard: incomingCallLoading/outgoingCallLoading
   refs prevent multiple playSound calls during async audio load.
   If call is cancelled while sound loads, stops it immediately on
   completion. Eliminates the "5 ringtones at once" bug.

3. Host dm_call_accepted broadcasts now include federatedCallId so
   all clients (including remote instances) can match the event.

4. Removed all diagnostic console.log statements.

packages/server/src/routes/federation.ts

@@ -3561,7 +3561,6 @@ function processDmCallAcceptEvent(
   accepted: string[],
   rejected: Array<{ messageId: string; reason: string }>,
 ): void {
-  console.log(`[S2S_CALL_ACCEPT] from=${sourceInstance} federatedId=${event.federatedId} acceptor=${JSON.stringify(event.call?.acceptor)}`);
   if (!event.call?.acceptor || !event.federatedId) {
     rejected.push({ messageId: event.messageId, reason: 'missing_call_payload' });
     return;
@@ -3577,11 +3576,9 @@ function processDmCallAcceptEvent(
     .where(eq(schema.dmChannels.federatedId, event.federatedId))
     .get();
   const dmChannelId = channel?.id;
-  console.log(`[S2S_CALL_ACCEPT] channel lookup: federatedId=${event.federatedId} → dmChannelId=${dmChannelId ?? 'NOT FOUND'}`);
 
   // Check if we're the HOST (have a VoiceRoom)
   const room = dmChannelId ? connectionManager.getRoom(dmChannelId) : undefined;
-  console.log(`[S2S_CALL_ACCEPT] room lookup: ${room ? `found (type=${room.roomType}, state=${(room.metadata as any).state})` : 'NOT FOUND'}`);
   if (room && room.roomType === 'dm') {
     const meta = room.metadata as DmRoomMeta;
 
@@ -3600,12 +3597,12 @@ function processDmCallAcceptEvent(
       });
     }
 
-    // Broadcast accepted locally
-    console.log(`[S2S_CALL_ACCEPT] HOST path: broadcasting dm_call_accepted to dmChannelId=${dmChannelId}`);
+    // Broadcast accepted locally — include federatedCallId so all clients can match
     connectionManager.sendToDmMembers(dmChannelId!, {
       type: 'dm_call_accepted',
       dmChannelId: dmChannelId!,
-    });
+      federatedCallId: event.federatedId,
+    } as ServerEvent);
 
     // Fan out to ALL other remote instances (exclude the one that sent the accept)
     const normalizedSource = sourceInstance.startsWith('http') ? sourceInstance : `https://${sourceInstance}`;

packages/server/src/routes/livekit.ts

@@ -48,7 +48,6 @@ export async function livekitRoutes(app: FastifyInstance): Promise<void> {
     }
 
     const { channelId, dmChannelId } = request.body as { channelId?: string; dmChannelId?: string };
-    console.log(`[LIVEKIT_TOKEN] userId=${request.userId} username=${request.username} channelId=${channelId} dmChannelId=${dmChannelId}`);
 
     // Determine room name based on channel type
     let roomName: string;
@@ -119,7 +118,6 @@ export async function livekitRoutes(app: FastifyInstance): Promise<void> {
     const jwt = await token.toJwt();
 
     const livekitUrl = config.livekit.url ?? '';
-    console.log(`[LIVEKIT_TOKEN] ISSUED room=${roomName} identity=${identity} url=${livekitUrl}`);
 
     const response: LiveKitTokenResponse = {
       token: jwt,