feat: voice messages, offline queue, delivery ticks, volume slider, admin + scaling

- Voice messages: MediaRecorder → encrypted attachment, custom waveform
  player via OfflineAudioContext, 60s limit + live mic-level meter
- Offline message queue: localStorage outbox, exponential backoff retries,
  optimistic pending bubble with retry/discard
- Delivery indicator: message_deliveries table + RLS (reciprocal receipts),
  ✓ / ✓✓ / ✓✓-blue tick states, group-aware (all members must ack)
- Per-participant volume slider in calls via right-click tile menu,
  persisted to localStorage, applied to attached audio elements
- Group call scaling: grid up to 12 tiles with pagination,
  active-speaker auto-promotion in fullscreen
- Push notifications scaffolding: service worker, VAPID subscription
  registration, notify-push edge function skeleton
- Backup recovery code: 24-char base32 code (~120 bits entropy) as
  alternative decrypt path, restore UI with mode toggle
- Admin panel: conversations list, audit log (admin_audit_log table +
  admin_log_action RPC), audit entry on user flag toggle
- Search v2: sender filter, attachment-only toggle, date range
- Reactions pop animation (scale 0.4→1.15→1 on count change)
- Message list windowing (150 default, expand via IntersectionObserver)
- Stub cleanup: removed dead ScreenshareStub from CallParticipantTile

Fixes:
- Focus-triggered flicker: dropped window.focus listeners in three spots,
  throttled visibilitychange/online wake-refreshes to 30s, keep existing
  data visible during background re-syncs (no more spinner on every click)
- Voice attachment audio element collapsed to 0px on peer side — now
  forces 280px min-width on bubble

Migrations (push required):
  20260421000001_message_deliveries.sql
  20260421000002_admin_audit_log.sql

Server TODO:
  VAPID keys + notify-push edge function deploy

packages/shared/src/chat/messages.ts

@@ -245,6 +245,134 @@ export async function listPeerReadsForMessages(
   return new Set((data ?? []).map((r) => r.message_id));
 }
 
+// Group variant: returns reads from ALL users (other than `excludeUserId`,
+// typically caller themselves) keyed by message id → user id → timestamp.
+// RLS already filters out users whose receipts are off.
+export async function listGroupReadsForMessages(
+  client: AppSupabaseClient,
+  messageIds: string[],
+  excludeUserId: string,
+): Promise<Map<string, Map<string, string>>> {
+  if (messageIds.length === 0) return new Map();
+  const { data, error } = await client
+    .from('message_reads')
+    .select('message_id, user_id, read_at')
+    .neq('user_id', excludeUserId)
+    .in('message_id', messageIds);
+  if (error) throw error;
+  const out = new Map<string, Map<string, string>>();
+  for (const row of data ?? []) {
+    const mid = row.message_id;
+    const uid = row.user_id;
+    const at = row.read_at;
+    let inner = out.get(mid);
+    if (!inner) {
+      inner = new Map();
+      out.set(mid, inner);
+    }
+    inner.set(uid, at);
+  }
+  return out;
+}
+
+// Group variant of delivery receipts. Same shape as listGroupReadsForMessages.
+export async function listGroupDeliveriesForMessages(
+  client: AppSupabaseClient,
+  messageIds: string[],
+  excludeUserId: string,
+): Promise<Map<string, Map<string, string>>> {
+  if (messageIds.length === 0) return new Map();
+  const { data, error } = await (client as unknown as {
+    from: (t: string) => {
+      select: (cols: string) => {
+        neq: (col: string, val: string) => {
+          in: (
+            col: string,
+            vals: string[],
+          ) => Promise<{
+            data:
+              | { message_id: string; user_id: string; delivered_at: string }[]
+              | null;
+            error: Error | null;
+          }>;
+        };
+      };
+    };
+  })
+    .from('message_deliveries')
+    .select('message_id, user_id, delivered_at')
+    .neq('user_id', excludeUserId)
+    .in('message_id', messageIds);
+  if (error) throw error;
+  const out = new Map<string, Map<string, string>>();
+  for (const row of data ?? []) {
+    let inner = out.get(row.message_id);
+    if (!inner) {
+      inner = new Map();
+      out.set(row.message_id, inner);
+    }
+    inner.set(row.user_id, row.delivered_at);
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------------------
+// Delivery receipts
+// ---------------------------------------------------------------------------
+
+// Records that the caller has received (fetched + decrypted) these messages.
+// Idempotent; composite PK absorbs duplicates.
+export async function markMessagesDelivered(
+  client: AppSupabaseClient,
+  messageIds: string[],
+): Promise<void> {
+  if (messageIds.length === 0) return;
+  const { data: session, error: aErr } = await client.auth.getUser();
+  if (aErr) throw aErr;
+  if (!session.user) return;
+  const myId = session.user.id;
+  const rows = messageIds.map((id) => ({ message_id: id, user_id: myId }));
+  // `message_deliveries` is a later migration and not yet in the generated
+  // Supabase types; skip the strict table-name check for this call.
+  const { error } = await (client as unknown as {
+    from: (t: string) => {
+      upsert: (
+        rows: unknown,
+        opts: { onConflict: string; ignoreDuplicates: boolean },
+      ) => Promise<{ error: Error | null }>;
+    };
+  })
+    .from('message_deliveries')
+    .upsert(rows, { onConflict: 'message_id,user_id', ignoreDuplicates: true });
+  if (error) throw error;
+}
+
+export async function listPeerDeliveriesForMessages(
+  client: AppSupabaseClient,
+  messageIds: string[],
+  peerUserId: string,
+): Promise<Set<string>> {
+  if (messageIds.length === 0) return new Set();
+  const { data, error } = await (client as unknown as {
+    from: (t: string) => {
+      select: (cols: string) => {
+        eq: (col: string, val: string) => {
+          in: (
+            col: string,
+            vals: string[],
+          ) => Promise<{ data: { message_id: string }[] | null; error: Error | null }>;
+        };
+      };
+    };
+  })
+    .from('message_deliveries')
+    .select('message_id')
+    .eq('user_id', peerUserId)
+    .in('message_id', messageIds);
+  if (error) throw error;
+  return new Set((data ?? []).map((r) => r.message_id));
+}
+
 // ---------------------------------------------------------------------------
 // Reactions
 // ---------------------------------------------------------------------------