feat: voice messages, offline queue, delivery ticks, volume slider, admin + scaling

- Voice messages: MediaRecorder → encrypted attachment, custom waveform
  player via OfflineAudioContext, 60s limit + live mic-level meter
- Offline message queue: localStorage outbox, exponential backoff retries,
  optimistic pending bubble with retry/discard
- Delivery indicator: message_deliveries table + RLS (reciprocal receipts),
  ✓ / ✓✓ / ✓✓-blue tick states, group-aware (all members must ack)
- Per-participant volume slider in calls via right-click tile menu,
  persisted to localStorage, applied to attached audio elements
- Group call scaling: grid up to 12 tiles with pagination,
  active-speaker auto-promotion in fullscreen
- Push notifications scaffolding: service worker, VAPID subscription
  registration, notify-push edge function skeleton
- Backup recovery code: 24-char base32 code (~120 bits entropy) as
  alternative decrypt path, restore UI with mode toggle
- Admin panel: conversations list, audit log (admin_audit_log table +
  admin_log_action RPC), audit entry on user flag toggle
- Search v2: sender filter, attachment-only toggle, date range
- Reactions pop animation (scale 0.4→1.15→1 on count change)
- Message list windowing (150 default, expand via IntersectionObserver)
- Stub cleanup: removed dead ScreenshareStub from CallParticipantTile

Fixes:
- Focus-triggered flicker: dropped window.focus listeners in three spots,
  throttled visibilitychange/online wake-refreshes to 30s, keep existing
  data visible during background re-syncs (no more spinner on every click)
- Voice attachment audio element collapsed to 0px on peer side — now
  forces 280px min-width on bubble

Migrations (push required):
  20260421000001_message_deliveries.sql
  20260421000002_admin_audit_log.sql

Server TODO:
  VAPID keys + notify-push edge function deploy

apps/desktop/src/lib/deviceBackup.ts

@@ -140,3 +140,59 @@ export async function importDeviceBackup(
 export function decodePrivateKeyFromBackup(payload: DeviceBackupPayload): Uint8Array {
   return unb64url(payload.privateKeyB64);
 }
+
+// ---------------------------------------------------------------------------
+// Recovery code
+// ---------------------------------------------------------------------------
+//
+// Generates a high-entropy code shown to the user once at backup time. The
+// same payload is encrypted twice — once with the user's passphrase, once
+// with the recovery code — so either string can decrypt the device key.
+//
+// The recovery code is 24 chars from a 32-symbol alphabet (no ambiguous
+// characters), grouped as 4×6. ~120 bits of entropy.
+
+const RECOVERY_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+
+export interface BackupBundle {
+  passphraseBackup: string;
+  recoveryBackup: string;
+  recoveryCode: string;
+}
+
+export async function exportDeviceBackupWithRecovery(params: {
+  userId: string;
+  deviceId: string;
+  privateKey: Uint8Array;
+  passphrase: string;
+}): Promise<BackupBundle> {
+  const recoveryCode = await generateRecoveryCode();
+  const [passphraseBackup, recoveryBackup] = await Promise.all([
+    exportDeviceBackup(params),
+    exportDeviceBackup({ ...params, passphrase: recoveryCode }),
+  ]);
+  return { passphraseBackup, recoveryBackup, recoveryCode };
+}
+
+async function generateRecoveryCode(): Promise<string> {
+  const s = await ensureSodium();
+  const raw = s.randombytes_buf(24);
+  let out = '';
+  for (let i = 0; i < raw.length; i++) {
+    out += RECOVERY_ALPHABET[raw[i]! % RECOVERY_ALPHABET.length];
+    if ((i + 1) % 6 === 0 && i !== raw.length - 1) out += '-';
+  }
+  return out;
+}
+
+// Normalizes a user-typed recovery code: strips dashes/spaces, uppercases,
+// maps look-alike characters. Lets users enter the code with imperfect
+// spacing without rejecting valid input.
+export function normalizeRecoveryCode(input: string): string {
+  return input
+    .toUpperCase()
+    .replace(/[\s-]/g, '')
+    .split('')
+    .filter((c) => RECOVERY_ALPHABET.includes(c))
+    .join('');
+}