fix: proxy LiveKit through HTTPS to fix mixed-content block

- Add reverse proxy at /livekit/* that forwards to LiveKit server
- Server sends relative URL "/livekit" in voice_token; client
  resolves to wss://server:port/livekit using known server host
- Fix API secret minimum length (32 chars required by LiveKit)
- Pass TLS config to LiveKit process manager for TURN certs

Server/config/config.go

@@ -101,7 +101,7 @@ func defaults() Config {
 		},
 		Voice: VoiceConfig{
 			LiveKitAPIKey:    "devkey",
-			LiveKitAPISecret: "secret",
+			LiveKitAPISecret: "owncord-dev-secret-key-min-32chars",
 			LiveKitURL:       "ws://localhost:7880",
 			Quality:          "medium",
 		},
@@ -139,8 +139,8 @@ upload:
   storage_dir: "data/uploads"
 
 voice:
-  livekit_api_key: "devkey"        # LiveKit API key
-  livekit_api_secret: "secret"     # LiveKit API secret
+  livekit_api_key: "devkey"                              # LiveKit API key
+  livekit_api_secret: "owncord-dev-secret-key-min-32chars"  # LiveKit API secret (min 32 chars)
   livekit_url: "ws://localhost:7880"  # LiveKit server WebSocket URL
   # livekit_binary: ""             # path to livekit-server binary; empty = don't auto-start
   # quality: "medium"              # low | medium | high

Server/config/config_test.go

@@ -242,7 +242,7 @@ func TestLoadVoiceConfigDefaults(t *testing.T) {
 	}{
 		{"Voice.Quality", cfg.Voice.Quality, "medium"},
 		{"Voice.LiveKitAPIKey", cfg.Voice.LiveKitAPIKey, "devkey"},
-		{"Voice.LiveKitAPISecret", cfg.Voice.LiveKitAPISecret, "secret"},
+		{"Voice.LiveKitAPISecret", cfg.Voice.LiveKitAPISecret, "owncord-dev-secret-key-min-32chars"},
 		{"Voice.LiveKitURL", cfg.Voice.LiveKitURL, "ws://localhost:7880"},
 	}