feat: known-good CPU audio + 1080p VAAPI + KMS display wall

Working snapshot before the OpenVINO MetricGAN GPU spike:
thread-capped SpeechBrain DelaySum+MetricGAN on CPU, hop 200 ms,
video hold for A/V sync, Arc VAAPI H.264, headless kmssink wall.
32 tests passing. Do not treat this as a GPU audio path.

tokens.py

@@ -18,3 +18,40 @@ def make_token(url: str, api_key: str, api_secret: str,
         ))
     )
     return token.to_jwt()
+
+
+def make_speaker_token(api_key: str, api_secret: str,
+                       room: str, identity: str = "speaker",
+                       name: str = "") -> str:
+    """Publisher token so a speaker can join and share their screen."""
+    token = (
+        AccessToken(api_key, api_secret)
+        .with_identity(identity)
+        .with_name(name or identity)
+        .with_grants(VideoGrants(
+            room_join=True,
+            room=room,
+            can_publish=True,
+            can_subscribe=True,
+            can_publish_data=True,
+        ))
+    )
+    return token.to_jwt()
+
+
+def make_viewer_token(api_key: str, api_secret: str,
+                      room: str, identity: str) -> str:
+    """Subscribe-only token for headless display clients."""
+    token = (
+        AccessToken(api_key, api_secret)
+        .with_identity(identity)
+        .with_name(identity)
+        .with_grants(VideoGrants(
+            room_join=True,
+            room=room,
+            can_publish=False,
+            can_subscribe=True,
+            can_publish_data=False,
+        ))
+    )
+    return token.to_jwt()