fix: resolve 24 critical and high issues from full code & security review

CRITICAL (5):
- Hub panic recovery now calls h.Stop() after 3 panics (ws/hub.go)
- Ring buffer EventsSince returns non-nil empty slice for current seq (ws/ringbuffer.go)
- PTT event listener stores unsubscribe handle to prevent leak (ptt.ts)
- verifyTotp respects config.allowSelfSigned instead of hardcoding (api.ts)
- ptt_listen_for_key uses spawn_blocking to avoid thread pool starvation (ptt.rs)

HIGH - Server (13):
- TOTP rate-limit checked after body decode; counters reset on success
- TOTP enable returns 409 if already enabled (must disable first)
- Global search pre-computes accessible channel IDs for FTS WHERE clause
- DeleteAccount queries roles by name instead of hard-coded IDs
- BackupToSafe uses absClean in VACUUM INTO
- Voice camera slot uses atomic EnableCameraIfUnderLimit DB method
- readPump snapshots voiceChID before unregister for TOCTOU safety
- Voice join sets state after token send; rollback takes broadcast flag
- Updater download uses probe pattern instead of overflow write
- Webhook checks Authorization header before reading body
- Storage.Save adds fsync and fixes double-close
- Default WS origin denies cross-origin (was: accept all)

HIGH - Client (6):
- WS reconnect uses generation counter to discard stale events
- AudioPipeline uses generation counter against stale worklet callbacks
- Screenshare mute state preserved across reconnect (not full leave)
- handleVoiceToken uses iterative loop instead of unbounded recursion
- store.ts re-entrancy guard with pending update queue
- Notification AudioContext cleaned up on logout

Reviewed by 4 parallel agents across Server Core, Server Realtime,
Client & Tauri, and Security. 55 total findings; 24 CRITICAL+HIGH
fixed here, 31 MEDIUM+LOW tracked in vault backlog (T-265–T-295).

Server/updater/updater.go

@@ -411,7 +411,7 @@ func (u *Updater) downloadFile(ctx context.Context, url, destPath string) error
 	// Cap download at 500 MiB to prevent unbounded disk usage from a
 	// malicious or corrupted release asset.
 	const maxBinarySize = 500 * 1024 * 1024
-	limitedReader := io.LimitReader(resp.Body, maxBinarySize+1)
+	limitedReader := io.LimitReader(resp.Body, maxBinarySize)
 
 	n, err := io.Copy(f, limitedReader)
 	if err != nil {
@@ -419,10 +419,14 @@ func (u *Updater) downloadFile(ctx context.Context, url, destPath string) error
 		_ = os.Remove(destPath)
 		return fmt.Errorf("writing downloaded file: %w", err)
 	}
-	if n > maxBinarySize {
-		_ = f.Close()
-		_ = os.Remove(destPath)
-		return fmt.Errorf("downloaded file exceeds maximum size of %d bytes", maxBinarySize)
+	// Probe for one more byte to detect if the file exceeds the limit.
+	if n == maxBinarySize {
+		var probe [1]byte
+		if extra, _ := resp.Body.Read(probe[:]); extra > 0 {
+			_ = f.Close()
+			_ = os.Remove(destPath)
+			return fmt.Errorf("downloaded file exceeds maximum size of %d bytes", maxBinarySize)
+		}
 	}
 
 	return nil