feat(desktop): capture system audio with process isolation

Electron's audio: 'loopback' captures the whole output mix, this app's own
playback included — so everyone else's voices went back out inside the share
and each listener heard themselves. Not acoustic echo but a digital copy of
the output, which is why headphones never helped, and why shareAudio already
defaulted to off in the desktop app.

Electron offers no way to exclude our own audio: the docs allow only
'loopback' or 'loopbackWithMute', and the handler discards the renderer's
constraints (restrictOwnAudio never arrives). electron-native-screenshare does
it at the OS level — WASAPI process loopback on Windows — capturing only the
shared window when its pid resolves, and otherwise everything except us.

The module hands raw PCM to the main process, so it crosses IPC and is
scheduled onto a running cursor in Web Audio to become a MediaStreamTrack,
published as ScreenShareAudio. Loading is optional and failure degrades to a
silent share rather than blocking the app or the screen share.

The browser path is untouched: Chrome honours restrictOwnAudio and has no echo.

Verified by typecheck (web and Electron main) and the web suite. The audio path
itself cannot be exercised here — no Windows, no Electron, no audio device.

packages/web/src/utils/screenShare.ts

@@ -1,5 +1,7 @@
 import { Room, Track, BackupCodecPolicy } from 'livekit-client';
 import { useVoiceStore } from '../stores/voiceStore';
+import { nativeScreenAudio } from './nativeScreenAudio';
+import { isElectron } from '../platform/platform';
 import type { ScreenShareConfig } from '../stores/voiceStore';
 import { getStreamingLimits } from '../stores/settingsStore';
 import { getPublisherPC, getMediaStreamTrack } from './livekitInternals';
@@ -253,7 +255,10 @@ export async function startScreenShare(room: Room): Promise<boolean> {
   try {
     // For native mode: omit resolution constraint to capture at display's full native resolution
     const captureOptions: any = {
-      audio: config.shareAudio ? {
+      // In the desktop app audio never comes through this stream: Electron
+      // ignores these constraints and its loopback would carry our own output
+      // back into the share. The native capture below supplies it instead.
+      audio: config.shareAudio && !isElectron() ? {
         // Chrome 141+: exclude this tab's own audio from system audio capture
         // @ts-ignore — restrictOwnAudio is not yet in all TS type definitions
         restrictOwnAudio: true,
@@ -287,6 +292,14 @@ export async function startScreenShare(room: Room): Promise<boolean> {
       return false;
     }
 
+    // Desktop only, and only after the video track exists: publishing the audio
+    // first would briefly show a share with sound and no picture. A failure
+    // here leaves the share running silently rather than tearing it down.
+    if (isElectron() && config.shareAudio) {
+      const ok = await nativeScreenAudio.start(room);
+      if (!ok) console.warn('[SS] native system audio unavailable — sharing without sound');
+    }
+
     // Set content hint from builder (motion for gaming, detail for text)
     const screenPub = room.localParticipant.getTrackPublications()
       .find(p => p.source === Track.Source.ScreenShare);
@@ -416,6 +429,9 @@ function scheduleEncoderDetection(room: Room): void {
 // ---------------------------------------------------------------------------
 
 export async function stopScreenShare(room: Room): Promise<void> {
+  // Stopped first: leaving the native capture running would keep reading system
+  // audio after the share is gone.
+  await nativeScreenAudio.stop();
   try {
     await room.localParticipant.setScreenShareEnabled(false);
   } catch (err) {