feat: HTTPS web frontend (self-signed) + server-side token endpoint

- nginx serves the UI over HTTPS on 8090 with a self-signed cert
  (browsers require a secure context for microphone access)
- added /token endpoint (tiny Python HTTP server) that signs LiveKit
  JWTs server-side, keeping the API secret out of the browser
- app.js now fetches a signed token from /token and uses wss:// when
  the page is served over HTTPS
- supervisord runs the token-server as a fourth process

Dockerfile

@@ -44,16 +44,24 @@ RUN curl -sSL "https://github.com/livekit/livekit/releases/download/${LIVEKIT_VE
 COPY --from=build /app/agent/.venv /opt/voice-agent/.venv
 COPY agent/agent.py /opt/voice-agent/agent.py
 
-# Copy web frontend
+# Copy web frontend + token endpoint
 COPY web/ /var/www/voice/
+COPY web/token_server.py /opt/voice/token_server.py
 
 # Config files
 COPY livekit.yaml /etc/livekit.yaml
 COPY supervisord.conf /etc/supervisor/conf.d/voice.conf
 
-# Configure nginx to serve the voice UI on port 8090
+# Configure nginx to serve the voice UI on port 8090 over HTTPS (self-signed)
+# Browsers require a secure context (HTTPS or localhost) for microphone access.
 RUN rm -f /etc/nginx/sites-enabled/default \
-    && printf 'server {\n    listen 8090;\n    root /var/www/voice;\n    index index.html;\n    location / {\n        try_files $uri $uri/ =404;\n    }\n}\n' \
+    && mkdir -p /etc/voice/certs \
+    && openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+        -keyout /etc/voice/certs/key.pem \
+        -out /etc/voice/certs/cert.pem \
+        -subj "/CN=voice.local" \
+        -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" \
+    && printf 'server {\n    listen 8090;\n    root /var/www/voice;\n    index index.html;\n    ssl_certificate /etc/voice/certs/cert.pem;\n    ssl_certificate_key /etc/voice/certs/key.pem;\n    location /token {\n        proxy_pass http://127.0.0.1:8091/token;\n        proxy_set_header Content-Type application/json;\n    }\n    location / {\n        try_files $uri $uri/ =404;\n    }\n}\n' \
     > /etc/nginx/sites-available/voice \
     && ln -sf /etc/nginx/sites-available/voice /etc/nginx/sites-enabled/voice