feat: point the fleet at wss LiveKit room uwh-telhai

Publish and subscribe over wss://livekit.uni-wh.de:7800 and refuse
cleartext ws://. Conference room is uwh-telhai. Includes the uncommitted
encoded H.264 publish path, Rally hairpin, and KMS wall overlay.

deploy/wait-for-livekit.sh

@@ -2,6 +2,9 @@
 # Wait until LIVEKIT_URL (from .env) accepts TCP. Used so publishers do not
 # race the local test livekit-server on boot. When LIVEKIT_URL points at a
 # remote host this waits on that host instead.
+#
+# bash /dev/tcp to an unreachable host can hang until the kernel SYN timeout
+# (longer than systemd TimeoutStartSec). Cap each probe at 1s.
 set -u
 ENV_FILE=/home/fdenkena/livekit-cameras/.env
 if [ -f "$ENV_FILE" ]; then
@@ -29,7 +32,7 @@ if [ "$host" = "localhost" ]; then
 fi
 echo "wait-for-livekit: $host:$port"
 for _ in $(seq 1 30); do
-  if (echo >/dev/tcp/"$host"/"$port") 2>/dev/null; then
+  if timeout 1 bash -c "echo >/dev/tcp/${host}/${port}" 2>/dev/null; then
     echo "wait-for-livekit: ready"
     exit 0
   fi