fix: harden booking and meeting flows

lib/meeting/token.ts

@@ -17,6 +17,8 @@ export type MeetingTokenPayload = {
   clientId?: string;
   name: string;
   role: MeetingRole;
+  accessVersion?: string;
+  testRoom?: boolean;
   exp: number; // unix ms
 };
 
@@ -41,6 +43,8 @@ export function createMeetingToken(args: {
   role: MeetingRole;
   clientId?: string;
   ttlMs?: number;
+  accessVersion?: string;
+  testRoom?: boolean;
 }): { token: string; participantId: string } {
   const participantId = randomUUID();
   const clientId =
@@ -53,6 +57,8 @@ export function createMeetingToken(args: {
     clientId,
     name: args.name,
     role: args.role,
+    accessVersion: args.accessVersion,
+    testRoom: args.testRoom,
     exp: Date.now() + (args.ttlMs ?? 6 * 60 * 60 * 1000), // 6h default
   };
   const body = base64url(JSON.stringify(payload));
@@ -76,7 +82,9 @@ export function verifyMeetingToken(token: unknown): MeetingTokenPayload | null {
     const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8")) as MeetingTokenPayload;
     if (
       !Number.isFinite(payload.exp) ||
-      payload.exp < Date.now() ||
+      payload.exp <= Date.now() ||
+      (payload.accessVersion !== undefined && !/^[0-9a-f]{64}$/.test(payload.accessVersion)) ||
+      (payload.testRoom !== undefined && typeof payload.testRoom !== "boolean") ||
       typeof payload.eventSlug !== "string" ||
       payload.eventSlug.length > 200 ||
       typeof payload.participantId !== "string" ||