feat: voice messages, offline queue, delivery ticks, volume slider, admin + scaling

- Voice messages: MediaRecorder → encrypted attachment, custom waveform
  player via OfflineAudioContext, 60s limit + live mic-level meter
- Offline message queue: localStorage outbox, exponential backoff retries,
  optimistic pending bubble with retry/discard
- Delivery indicator: message_deliveries table + RLS (reciprocal receipts),
  ✓ / ✓✓ / ✓✓-blue tick states, group-aware (all members must ack)
- Per-participant volume slider in calls via right-click tile menu,
  persisted to localStorage, applied to attached audio elements
- Group call scaling: grid up to 12 tiles with pagination,
  active-speaker auto-promotion in fullscreen
- Push notifications scaffolding: service worker, VAPID subscription
  registration, notify-push edge function skeleton
- Backup recovery code: 24-char base32 code (~120 bits entropy) as
  alternative decrypt path, restore UI with mode toggle
- Admin panel: conversations list, audit log (admin_audit_log table +
  admin_log_action RPC), audit entry on user flag toggle
- Search v2: sender filter, attachment-only toggle, date range
- Reactions pop animation (scale 0.4→1.15→1 on count change)
- Message list windowing (150 default, expand via IntersectionObserver)
- Stub cleanup: removed dead ScreenshareStub from CallParticipantTile

Fixes:
- Focus-triggered flicker: dropped window.focus listeners in three spots,
  throttled visibilitychange/online wake-refreshes to 30s, keep existing
  data visible during background re-syncs (no more spinner on every click)
- Voice attachment audio element collapsed to 0px on peer side — now
  forces 280px min-width on bubble

Migrations (push required):
  20260421000001_message_deliveries.sql
  20260421000002_admin_audit_log.sql

Server TODO:
  VAPID keys + notify-push edge function deploy

supabase/migrations/20260421000002_admin_audit_log.sql

@@ -0,0 +1,63 @@
+-- ============================================================================
+-- Admin audit log — append-only journal of administrative actions. Writes
+-- go through an RPC so the insert path is a single choke-point with input
+-- validation; reads are admin-only via RLS.
+-- ============================================================================
+create table public.admin_audit_log (
+  id          uuid primary key default gen_random_uuid(),
+  actor_id    uuid not null references auth.users(id) on delete set null,
+  action      text not null,
+  target_type text,
+  target_id   text,
+  metadata    jsonb not null default '{}'::jsonb,
+  created_at  timestamptz not null default now()
+);
+
+create index admin_audit_log_created_at_idx on public.admin_audit_log (created_at desc);
+create index admin_audit_log_actor_idx on public.admin_audit_log (actor_id);
+
+alter table public.admin_audit_log enable row level security;
+
+create policy audit_log_select_admin on public.admin_audit_log
+  for select to authenticated
+  using (public.current_user_is_admin());
+
+-- Insert via RPC only — no direct insert policy, so clients can't forge rows
+-- with a different actor_id.
+create or replace function public.admin_log_action(
+  p_action text,
+  p_target_type text default null,
+  p_target_id text default null,
+  p_metadata jsonb default '{}'::jsonb
+) returns uuid
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  new_id uuid;
+begin
+  if not public.current_user_is_admin() then
+    raise exception 'not an admin';
+  end if;
+  insert into public.admin_audit_log (actor_id, action, target_type, target_id, metadata)
+    values (auth.uid(), p_action, p_target_type, p_target_id, coalesce(p_metadata, '{}'::jsonb))
+    returning id into new_id;
+  return new_id;
+end;
+$$;
+
+revoke all on function public.admin_log_action(text, text, text, jsonb) from public;
+grant execute on function public.admin_log_action(text, text, text, jsonb) to authenticated;
+
+-- ============================================================================
+-- Admin conversations view — lets admins list every conversation (bypassing
+-- is_conversation_member). Read-only: no writes flow through the view.
+-- ============================================================================
+create policy conversations_select_admin on public.conversations
+  for select to authenticated
+  using (public.current_user_is_admin());
+
+create policy conversation_members_select_admin on public.conversation_members
+  for select to authenticated
+  using (public.current_user_is_admin());