feat: LiveKit migration — permissions, auth hardening, voice improvements

Pre-review snapshot of LiveKit migration changes including:
- Permission computation fix (allow-wins semantics)
- Timing-safe password comparison with dummy hash
- Rate limiter window fix
- Dev credential clearing for LiveKit
- Voice leave/join broadcast improvements
- Migration transaction wrapping
- Chat edit/delete permission guards
- TOTP verification endpoint
- Embed regex injection fix

Client/tauri-client/src-tauri/Cargo.lock

@@ -2594,7 +2594,7 @@ dependencies = [
 
 [[package]]
 name = "owncord-client"
-version = "1.2.0"
+version = "1.3.0"
 dependencies = [
  "futures-util",
  "ring",

Client/tauri-client/src-tauri/src/commands.rs

@@ -75,6 +75,9 @@ pub fn store_cert_fingerprint(
     host: String,
     fingerprint: String,
 ) -> Result<(), String> {
+    // Normalize to lowercase for consistent comparison with ws_proxy fingerprints
+    let fingerprint = fingerprint.to_lowercase();
+
     if host.is_empty() {
         return Err("host must not be empty".into());
     }
@@ -82,7 +85,7 @@ pub fn store_cert_fingerprint(
         return Err("fingerprint must not be empty".into());
     }
 
-    // Validate SHA-256 colon-hex format: "AA:BB:CC:..." (95 chars, 32 hex pairs)
+    // Validate SHA-256 colon-hex format: "aa:bb:cc:..." (95 chars, 32 hex pairs)
     if fingerprint.len() != 95 {
         return Err("fingerprint must be a SHA-256 colon-hex string (95 chars)".into());
     }