feat: point the fleet at wss LiveKit room uwh-telhai

Publish and subscribe over wss://livekit.uni-wh.de:7800 and refuse
cleartext ws://. Conference room is uwh-telhai. Includes the uncommitted
encoded H.264 publish path, Rally hairpin, and KMS wall overlay.

tests/test_tokens.py

@@ -0,0 +1,24 @@
+import jwt
+
+from tokens import make_token
+
+
+def test_make_token_includes_uwh_attributes():
+    token = make_token(
+        "ws://127.0.0.1:7880", "devkey", "secret", "cameras", "cam-01",
+        attributes={"tag": "uwh", "tags": "uwh"},
+    )
+    claims = jwt.decode(token, "secret", algorithms=["HS256"])
+    assert claims["sub"] == "cam-01"
+    video = claims.get("video") or {}
+    assert video.get("canPublish") is True
+    assert video.get("canSubscribe") is False
+    assert claims["attributes"]["tag"] == "uwh"
+    assert claims["attributes"]["tags"] == "uwh"
+
+
+def test_make_token_omits_attributes_when_empty():
+    token = make_token(
+        "ws://127.0.0.1:7880", "devkey", "secret", "cameras", "cam-01")
+    claims = jwt.decode(token, "secret", algorithms=["HS256"])
+    assert "attributes" not in claims or not claims.get("attributes")