feat: point the fleet at wss LiveKit room uwh-telhai

Publish and subscribe over wss://livekit.uni-wh.de:7800 and refuse
cleartext ws://. Conference room is uwh-telhai. Includes the uncommitted
encoded H.264 publish path, Rally hairpin, and KMS wall overlay.

tests/test_vaapi_pin.py

@@ -0,0 +1,38 @@
+from vaapi_pin import (
+    classify_render_nodes,
+    igpu_render,
+    pin_encode_env,
+    should_pin_vaapi,
+)
+
+
+def test_classify_by_pci_even_if_card_numbers_swap():
+    def pci_id_of(node: str) -> str:
+        return {
+            "/dev/dri/renderD128": "0xe20b",
+            "/dev/dri/renderD129": "0xa780",
+        }[node]
+
+    c = classify_render_nodes(
+        ["/dev/dri/renderD128", "/dev/dri/renderD129"],
+        pci_id_of=pci_id_of,
+    )
+    assert c["arc"] == "/dev/dri/renderD128"
+    assert c["igpu"] == "/dev/dri/renderD129"
+
+
+def test_pin_encode_env_points_at_igpu_not_arc():
+    env = pin_encode_env({}, igpu="/dev/dri/renderD129")
+    assert env["LIBVA_DRIVER_NAME"] == "iHD"
+    assert env["LIVEKIT_ENCODE_RENDER"] == "/dev/dri/renderD129"
+    assert env.get("LIBVA_DRM_DEVICE") != "/dev/dri/renderD128"
+
+
+def test_should_not_pin_vaapi_when_preencoded():
+    assert should_pin_vaapi(preencoded=True) is False
+    assert should_pin_vaapi(preencoded=False) is True
+
+
+def test_igpu_render_matches_live_a780():
+    node = igpu_render()
+    assert node.startswith("/dev/dri/renderD")