Add Rust server

Owns the database, PIN rotation and all LiveKit token minting. Kiosk
registration, session-stable joins, admin auth, layouts, branding, media
uploads and the hosted installer script.

server/src/livekit.rs

@@ -0,0 +1,78 @@
+use chrono::Utc;
+use jsonwebtoken::{encode, EncodingKey, Header};
+use serde::Serialize;
+
+use crate::error::AppResult;
+
+#[derive(Serialize)]
+struct VideoGrant {
+    room: String,
+    #[serde(rename = "roomJoin")]
+    room_join: bool,
+    #[serde(rename = "canPublish")]
+    can_publish: bool,
+    #[serde(rename = "canSubscribe")]
+    can_subscribe: bool,
+    #[serde(rename = "canPublishData")]
+    can_publish_data: bool,
+    #[serde(rename = "canUpdateOwnMetadata")]
+    can_update_own_metadata: bool,
+    #[serde(rename = "roomAdmin")]
+    room_admin: bool,
+}
+
+#[derive(Serialize)]
+struct AccessTokenClaims {
+    iss: String,
+    sub: String,
+    nbf: i64,
+    exp: i64,
+    name: String,
+    metadata: String,
+    video: VideoGrant,
+}
+
+pub struct TokenRequest<'a> {
+    pub room_name: &'a str,
+    pub identity: &'a str,
+    pub display_name: &'a str,
+    pub role: &'a str,
+    pub can_publish: bool,
+    pub room_admin: bool,
+    pub ttl_seconds: i64,
+}
+
+pub fn mint_access_token(
+    api_key: &str,
+    api_secret: &str,
+    request: TokenRequest<'_>,
+) -> AppResult<(String, i64)> {
+    let issued_at = Utc::now().timestamp();
+    let expires_at = issued_at + request.ttl_seconds;
+
+    let claims = AccessTokenClaims {
+        iss: api_key.to_string(),
+        sub: request.identity.to_string(),
+        nbf: issued_at - 10,
+        exp: expires_at,
+        name: request.display_name.to_string(),
+        metadata: serde_json::json!({ "role": request.role }).to_string(),
+        video: VideoGrant {
+            room: request.room_name.to_string(),
+            room_join: true,
+            can_publish: request.can_publish,
+            can_subscribe: true,
+            can_publish_data: true,
+            can_update_own_metadata: true,
+            room_admin: request.room_admin,
+        },
+    };
+
+    let token = encode(
+        &Header::default(),
+        &claims,
+        &EncodingKey::from_secret(api_secret.as_bytes()),
+    )?;
+
+    Ok((token, expires_at))
+}