feat: voice messages, offline queue, delivery ticks, volume slider, admin + scaling

- Voice messages: MediaRecorder → encrypted attachment, custom waveform
  player via OfflineAudioContext, 60s limit + live mic-level meter
- Offline message queue: localStorage outbox, exponential backoff retries,
  optimistic pending bubble with retry/discard
- Delivery indicator: message_deliveries table + RLS (reciprocal receipts),
  ✓ / ✓✓ / ✓✓-blue tick states, group-aware (all members must ack)
- Per-participant volume slider in calls via right-click tile menu,
  persisted to localStorage, applied to attached audio elements
- Group call scaling: grid up to 12 tiles with pagination,
  active-speaker auto-promotion in fullscreen
- Push notifications scaffolding: service worker, VAPID subscription
  registration, notify-push edge function skeleton
- Backup recovery code: 24-char base32 code (~120 bits entropy) as
  alternative decrypt path, restore UI with mode toggle
- Admin panel: conversations list, audit log (admin_audit_log table +
  admin_log_action RPC), audit entry on user flag toggle
- Search v2: sender filter, attachment-only toggle, date range
- Reactions pop animation (scale 0.4→1.15→1 on count change)
- Message list windowing (150 default, expand via IntersectionObserver)
- Stub cleanup: removed dead ScreenshareStub from CallParticipantTile

Fixes:
- Focus-triggered flicker: dropped window.focus listeners in three spots,
  throttled visibilitychange/online wake-refreshes to 30s, keep existing
  data visible during background re-syncs (no more spinner on every click)
- Voice attachment audio element collapsed to 0px on peer side — now
  forces 280px min-width on bubble

Migrations (push required):
  20260421000001_message_deliveries.sql
  20260421000002_admin_audit_log.sql

Server TODO:
  VAPID keys + notify-push edge function deploy

apps/desktop/src/context/CallContext.tsx

@@ -47,6 +47,7 @@ import {
   getCallE2EESettings,
   isE2EESupported,
 } from '../lib/callE2EE';
+import { getParticipantVolume } from '../lib/participantVolumes';
 import {
   type DisplaySurfaceHint,
   getPresetParams,
@@ -1310,7 +1311,7 @@ async function broadcastPresence(room: Room, deafened: boolean): Promise<void> {
 function attachTrack(
   track: RemoteTrack,
   _publication: RemoteTrackPublication,
-  _participant: RemoteParticipant,
+  participant: RemoteParticipant,
 ): void {
   if (track.kind === Track.Kind.Audio) {
     const audio = track.attach();
@@ -1318,6 +1319,10 @@ function attachTrack(
       audio.autoplay = true;
       audio.setAttribute('playsinline', 'true');
       audio.setAttribute('data-livekit-track', track.sid ?? '');
+      if (participant.identity) {
+        audio.setAttribute('data-participant', participant.identity);
+        audio.volume = getParticipantVolume(participant.identity);
+      }
       if (deafenedActive) audio.muted = true;
       document.body.appendChild(audio);
       // Apply persisted sinkId so the element routes to the user's chosen