Integrate LiveKit SFU and harden booking workflow

.env.example

@@ -51,13 +51,14 @@ SMTP_USER=
 SMTP_PASSWORD=
 SMTP_FROM="ANOUMA <support@anouma.org>"
 
-# ── WebRTC (STUN/TURN) ──────────────────────────────────────────────────
-# P2P works with just STUN for most networks. Add a TURN server later for
-# restrictive NATs/firewalls — no code changes needed, just set these.
-STUN_SERVER=stun:stun.l.google.com:19302
-TURN_SERVER=
-TURN_USERNAME=
-TURN_PASSWORD=
+# ── LiveKit SFU / embedded TURN ─────────────────────────────────────────
+# Public HTTPS endpoint of the self-hosted LiveKit server. The app converts
+# https:// to wss:// for browsers and uses the same endpoint for its API.
+# Put a trusted TLS reverse proxy in front of LiveKit (normally on :7880).
+LIVEKIT_URL=https://livekit.example.com
+# Keep these values private. setup.sh generates them automatically.
+LIVEKIT_API_KEY=LKreplace-with-setup-secret
+LIVEKIT_API_SECRET=replace-with-setup-secret
 
 # ── SEO ──────────────────────────────────────────────────────────────────
 # Optional Google Search Console domain-verification token (Search Console →