[GH-122] Fix landing, camera lifecycle, settings and dependencies

[alexanderbrunker-star]

Summary

Fix broken invitation parsing and ineffective browser settings, release camera/session resources when navigation interrupts startup, and make countdown cancellation prevent capture. Improve landing accessibility and iOS identity settings; update dependency manifests and lockfiles (including Vitest 5.0.1) with zero npm audit findings. Version 2.4.4.

Tracking

Closes #122. Linear is unavailable; the user explicitly approved GitHub-only tracking.

Test plan

• Web: 59 unit tests, TypeScript and production build, zero npm audit findings.
• Browser: 25 passed; one no-backend fallback skipped with backend configured. Covers invite tokens, invalid codes, legal pages, reduced motion, 320/390/1440px layouts, host/join flows.
• Server: 10 tests, build, zero npm audit findings.
• iOS: 83 unit tests; 3 targeted UI tests on iOS 26.5 / iPhone 17 Pro Max.
• SwiftLint strict: zero violations.
• CI config generator: four tests; fixed URL escaping and secretless PR fixtures.
• Reviewed CodeQL update merged in chore(deps): Bump github/codeql-action from 4.37.4 to 4.38.0 #129.
• Independent review: no critical or important findings after fixes.
• Centralized new labels, accessibility identifiers, version and changelog.
• Physical multi-device/Watch smoke test (not performed).

Screenshots

Full validation record

Risk / rollback

Browser-hosted sessions now advertise the actual host-only capture policy; nonfunctional viewer-trigger permission choices were removed. iOS permissions are unchanged. Revert this PR to roll back. No production database migration or App Store release.