feat(app): 1:1 voice and video calls

End-to-end encrypted calls between two contacts over WebRTC. Call
signalling (offer, answer, hang-up) travels as ordinary Signal-encrypted
messages through the relay; media is DTLS-SRTP, peer to peer when
possible and through the operator's TURN server otherwise.

- Non-trickle ICE (candidates gathered for up to 3 s), 45 s ring
  timeout, busy handling, and a call log entry in the conversation.
- The system call UI rings even when the app is closed: CallKit from a
  PushKit VoIP push on iOS, a full-screen incoming call from an FCM
  wake-up on Android. The wake-up carries no caller; the app learns who
  is calling from the queued offer once it is unlocked.
- New permissions: camera for video, audio routing and Bluetooth
  headsets, network state; iOS background modes audio and voip.

Push on Android: a fresh install now picks UnifiedPush when a
distributor is installed and FCM otherwise, instead of leaving wake-ups
off. Without a wake-up Android puts the app to sleep and messages wait
until it is opened. Users can switch at any time in Settings.

app/pubspec.yaml

@@ -53,6 +53,11 @@ dependencies:
   record: ^6.2.1
   audioplayers: ^6.7.1
   screen_protector: ^1.5.2
+  # Hovory: WebRTC média, DTLS-SRTP je v protokolu povinné.
+  flutter_webrtc: ^1.6.2
+  # Zvonění při zavřené appce: CallKit (iOS, z VoIP pushe) a celoobrazovkové
+  # zvonění na Androidu (z FCM budíčku k=call).
+  flutter_callkit_incoming: ^3.1.6
 
 dev_dependencies:
   integration_test: