Integrate LiveKit SFU and harden booking workflow

next.config.ts

@@ -23,9 +23,8 @@ const baseSecurityHeaders = [
 // Deliberately NOT applied to /admin or /api: Payload's admin bundle isn't
 // audited here for CSP compatibility, and API routes serve data, not HTML,
 // so a content policy doesn't apply to them anyway. connect-src stays broad
-// (rather than 'self') because the WebRTC call pages connect to whatever
-// STUN/TURN server is configured via env vars at runtime (see
-// lib/meeting/iceServers.ts) — that host isn't known here. style-src needs
+// because the WebRTC call pages connect to the separately hosted LiveKit SFU
+// at runtime. style-src needs
 // 'unsafe-inline' because framer-motion drives its animations through
 // inline style attributes. script-src allows 'unsafe-eval' only in dev,
 // matching Next's own documented CSP guidance — React uses eval there for
@@ -48,8 +47,8 @@ const frontendCSP = [
 ].join("; ");
 
 const nextConfig: NextConfig = {
-  // NOT "standalone": this project uses a custom server (server.ts) for the
-  // WebRTC signaling WebSocket, and standalone output can't be combined with
+  // NOT "standalone": this project uses a custom server (server.ts), and
+  // standalone output can't be combined with
   // a custom server. The Dockerfile runs the full app via `npm start` instead.
   images: {
     localPatterns: [