feat(app): 1:1 voice and video calls

End-to-end encrypted calls between two contacts over WebRTC. Call
signalling (offer, answer, hang-up) travels as ordinary Signal-encrypted
messages through the relay; media is DTLS-SRTP, peer to peer when
possible and through the operator's TURN server otherwise.

- Non-trickle ICE (candidates gathered for up to 3 s), 45 s ring
  timeout, busy handling, and a call log entry in the conversation.
- The system call UI rings even when the app is closed: CallKit from a
  PushKit VoIP push on iOS, a full-screen incoming call from an FCM
  wake-up on Android. The wake-up carries no caller; the app learns who
  is calling from the queued offer once it is unlocked.
- New permissions: camera for video, audio routing and Bluetooth
  headsets, network state; iOS background modes audio and voip.

Push on Android: a fresh install now picks UnifiedPush when a
distributor is installed and FCM otherwise, instead of leaving wake-ups
off. Without a wake-up Android puts the app to sleep and messages wait
until it is opened. Users can switch at any time in Settings.

app/ios/Runner/AppDelegate.swift

@@ -1,8 +1,14 @@
+import CallKit
 import Flutter
+import PushKit
 import UIKit
+import WebRTC
+import flutter_callkit_incoming
 
 @main
-@objc class AppDelegate: FlutterAppDelegate {
+@objc class AppDelegate: FlutterAppDelegate, PKPushRegistryDelegate, CallkitIncomingAppDelegate {
+  // PushKit registry musí žít po celou dobu běhu appky, jinak VoIP pushe nechodí.
+  private var voipRegistry: PKPushRegistry?
   private var apnsChannel: FlutterMethodChannel?
   // Token dorazí asynchronně z APNs; když si o něj Dart řekne dřív, podržíme ho.
   private var pendingToken: String?
@@ -29,13 +35,100 @@ import UIKit
     apnsChannel = channel
 
     GeneratedPluginRegistrant.register(with: self)
+
+    // Hovory: VoIP push z relaye → CallKit.
+    let registry = PKPushRegistry(queue: DispatchQueue.main)
+    registry.delegate = self
+    registry.desiredPushTypes = [.voIP]
+    voipRegistry = registry
+
+    // Zvukovou relaci u hovoru řídí CallKit; WebRTC ji smí zapnout až po
+    // jeho aktivaci (didActivateAudioSession), jinak hovor z uzamčené
+    // obrazovky nemá zvuk.
+    RTCAudioSession.sharedInstance().useManualAudio = true
+    RTCAudioSession.sharedInstance().isAudioEnabled = false
+
     return super.application(application, didFinishLaunchingWithOptions: launchOptions)
   }
 
+  // MARK: - PushKit (VoIP)
+
+  func pushRegistry(_ registry: PKPushRegistry, didUpdate credentials: PKPushCredentials, for type: PKPushType) {
+    let token = credentials.token.map { String(format: "%02x", $0) }.joined()
+    SwiftFlutterCallkitIncomingPlugin.sharedInstance?.setDevicePushTokenVoIP(token)
+  }
+
+  func pushRegistry(_ registry: PKPushRegistry, didInvalidatePushTokenFor type: PKPushType) {
+    SwiftFlutterCallkitIncomingPlugin.sharedInstance?.setDevicePushTokenVoIP("")
+  }
+
+  // iOS vyžaduje, aby každý VoIP push HNED skončil hovorem v CallKitu — jinak
+  // appku ukončí a po opakování VoIP pushe přestane doručovat. Relay neví,
+  // kdo volá (sealed sender), proto zvoní „Šepot“; Dart zvonění spáruje
+  // s nabídkou podle `extra.push`, až ji po připojení dešifruje.
+  func pushRegistry(
+    _ registry: PKPushRegistry,
+    didReceiveIncomingPushWith payload: PKPushPayload,
+    for type: PKPushType,
+    completion: @escaping () -> Void
+  ) {
+    guard type == .voIP else {
+      completion()
+      return
+    }
+    let data = flutter_callkit_incoming.Data(
+      id: UUID().uuidString, nameCaller: "Šepot", handle: "Šepot", type: 0)
+    data.appName = "Šepot"
+    data.duration = 45000
+    data.extra = ["push": true]
+    data.handleType = "generic"
+    data.supportsVideo = true
+    data.maximumCallGroups = 1
+    data.maximumCallsPerCallGroup = 1
+    data.supportsHolding = false
+    data.supportsDTMF = false
+    data.includesCallsInRecents = false
+    SwiftFlutterCallkitIncomingPlugin.sharedInstance?.showCallkitIncoming(data, fromPushKit: true) {
+      completion()
+    }
+    // Běží-li Dart, ať se hned připojí a vyzvedne nabídku z fronty.
+    apnsChannel?.invokeMethod("onWake", arguments: nil)
+  }
+
+  // MARK: - CallKit
+  // Rozhodnutí (přijmout/odmítnout) řeší Dart přes události pluginu;
+  // tady jen potvrdit akci CallKitu, jinak by ji systém po čase zrušil.
+
+  func onAccept(_ call: Call, _ action: CXAnswerCallAction) {
+    action.fulfill()
+  }
+
+  func onDecline(_ call: Call, _ action: CXEndCallAction) {
+    action.fulfill()
+  }
+
+  func onEnd(_ call: Call, _ action: CXEndCallAction) {
+    action.fulfill()
+  }
+
+  func onTimeOut(_ call: Call) {}
+
+  func didActivateAudioSession(_ audioSession: AVAudioSession) {
+    RTCAudioSession.sharedInstance().audioSessionDidActivate(audioSession)
+    RTCAudioSession.sharedInstance().isAudioEnabled = true
+  }
+
+  func didDeactivateAudioSession(_ audioSession: AVAudioSession) {
+    RTCAudioSession.sharedInstance().audioSessionDidDeactivate(audioSession)
+    RTCAudioSession.sharedInstance().isAudioEnabled = false
+  }
+
+  func providerDidReset() {}
+
   // APNs vydal device token → předáme Dartu (ten ho pošle relayi).
   override func application(
     _ application: UIApplication,
-    didRegisterForRemoteNotificationsWithDeviceToken deviceToken: Data
+    didRegisterForRemoteNotificationsWithDeviceToken deviceToken: Foundation.Data
   ) {
     let token = deviceToken.map { String(format: "%02x", $0) }.joined()
     pendingToken = token

app/ios/Runner/Info.plist

@@ -5,9 +5,11 @@
 		<key>UIBackgroundModes</key>
 		<array>
 			<string>remote-notification</string>
+			<string>audio</string>
+			<string>voip</string>
 		</array>
 		<key>NSCameraUsageDescription</key>
-		<string>The camera is used to scan contacts' QR codes and to take photos for attachments.</string>
+		<string>The camera is used to scan contacts' QR codes, take photos for attachments and for video calls.</string>
 		<key>NSPhotoLibraryUsageDescription</key>
 		<string>The photo library is used to pick photos to send in a conversation.</string>
 		<key>NSFaceIDUsageDescription</key>
@@ -66,6 +68,6 @@
 		<key>UIStatusBarHidden</key>
 		<false/>
 		<key>NSMicrophoneUsageDescription</key>
-		<string>Šepot needs the microphone to record voice messages.</string>
+		<string>Šepot needs the microphone for voice messages and calls.</string>
 	</dict>
 </plist>

app/ios/Runner/cs.lproj/InfoPlist.strings

@@ -1,5 +1,5 @@
 /* Šepot — texty oprávnění iOS (čeština) */
-"NSCameraUsageDescription" = "Kamera slouží ke skenování QR kódů kontaktů a focení příloh.";
+"NSCameraUsageDescription" = "Kamera slouží ke skenování QR kódů kontaktů, focení příloh a videohovorům.";
 "NSPhotoLibraryUsageDescription" = "Galerie slouží k výběru fotek pro odeslání v konverzaci.";
 "NSFaceIDUsageDescription" = "Face ID odemyká aplikaci místo PINu.";
-"NSMicrophoneUsageDescription" = "Šepot potřebuje mikrofon pro nahrávání hlasových zpráv.";
+"NSMicrophoneUsageDescription" = "Šepot potřebuje mikrofon pro hlasové zprávy a hovory.";

app/ios/Runner/de.lproj/InfoPlist.strings

@@ -1,5 +1,5 @@
 /* Šepot — iOS-Berechtigungstexte (Deutsch) */
-"NSCameraUsageDescription" = "Die Kamera dient zum Scannen der QR-Codes deiner Kontakte und zum Aufnehmen von Fotos für Anhänge.";
+"NSCameraUsageDescription" = "Die Kamera dient zum Scannen der QR-Codes deiner Kontakte, zum Aufnehmen von Fotos für Anhänge und für Videoanrufe.";
 "NSPhotoLibraryUsageDescription" = "Die Fotomediathek dient zum Auswählen von Fotos, die du in einer Unterhaltung sendest.";
 "NSFaceIDUsageDescription" = "Face ID entsperrt die App anstelle der PIN.";
-"NSMicrophoneUsageDescription" = "Šepot benötigt das Mikrofon zum Aufnehmen von Sprachnachrichten.";
+"NSMicrophoneUsageDescription" = "Šepot benötigt das Mikrofon für Sprachnachrichten und Anrufe.";

app/ios/Runner/en.lproj/InfoPlist.strings

@@ -1,5 +1,5 @@
 /* Šepot — iOS permission strings (English) */
-"NSCameraUsageDescription" = "The camera is used to scan contacts' QR codes and to take photos for attachments.";
+"NSCameraUsageDescription" = "The camera is used to scan contacts' QR codes, take photos for attachments and for video calls.";
 "NSPhotoLibraryUsageDescription" = "The photo library is used to pick photos to send in a conversation.";
 "NSFaceIDUsageDescription" = "Face ID unlocks the app instead of your PIN.";
-"NSMicrophoneUsageDescription" = "Šepot needs the microphone to record voice messages.";
+"NSMicrophoneUsageDescription" = "Šepot needs the microphone for voice messages and calls.";

app/ios/Runner/it.lproj/InfoPlist.strings

@@ -1,5 +1,5 @@
 /* Šepot — testi delle autorizzazioni iOS (italiano) */
-"NSCameraUsageDescription" = "La fotocamera serve a scansionare i codici QR dei contatti e a scattare foto per gli allegati.";
+"NSCameraUsageDescription" = "La fotocamera serve a scansionare i codici QR dei contatti, a scattare foto per gli allegati e per le videochiamate.";
 "NSPhotoLibraryUsageDescription" = "La libreria foto serve a scegliere le foto da inviare in una conversazione.";
 "NSFaceIDUsageDescription" = "Face ID sblocca l'app al posto del PIN.";
-"NSMicrophoneUsageDescription" = "Šepot ha bisogno del microfono per registrare i messaggi vocali.";
+"NSMicrophoneUsageDescription" = "Šepot ha bisogno del microfono per i messaggi vocali e le chiamate.";

app/ios/Runner/ru.lproj/InfoPlist.strings

@@ -1,5 +1,5 @@
 /* Šepot — тексты разрешений iOS (русский) */
-"NSCameraUsageDescription" = "Камера используется для сканирования QR-кодов контактов и съёмки фотографий для вложений.";
+"NSCameraUsageDescription" = "Камера используется для сканирования QR-кодов контактов, съёмки фотографий для вложений и видеозвонков.";
 "NSPhotoLibraryUsageDescription" = "Галерея используется для выбора фотографий, которые вы отправляете в чате.";
 "NSFaceIDUsageDescription" = "Face ID разблокирует приложение вместо PIN-кода.";
-"NSMicrophoneUsageDescription" = "Для записи голосовых сообщений приложению Šepot нужен доступ к микрофону.";
+"NSMicrophoneUsageDescription" = "Приложению Šepot нужен доступ к микрофону для голосовых сообщений и звонков.";