feat: HTTPS web frontend (self-signed) + server-side token endpoint

- nginx serves the UI over HTTPS on 8090 with a self-signed cert
  (browsers require a secure context for microphone access)
- added /token endpoint (tiny Python HTTP server) that signs LiveKit
  JWTs server-side, keeping the API secret out of the browser
- app.js now fetches a signed token from /token and uses wss:// when
  the page is served over HTTPS
- supervisord runs the token-server as a fourth process

web/token_server.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Tiny token endpoint for the voice UI.
+
+Serves POST /token -> { "token": "<signed JWT>" }
+Signs a LiveKit access token with HS256 using the API key/secret from env.
+Runs as a separate supervisord process; nginx proxies /token to it.
+"""
+import base64
+import hashlib
+import hmac
+import json
+import os
+import time
+import uuid
+
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+API_KEY = os.environ.get("LIVEKIT_API_KEY", "devkey")
+API_SECRET = os.environ.get("LIVEKIT_API_SECRET", "devsecret")
+
+
+def b64url(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def make_token(room_name: str) -> str:
+    now = int(time.time())
+    header = {"alg": "HS256", "typ": "JWT"}
+    payload = {
+        "iss": API_KEY,
+        "sub": room_name,
+        "nbf": now - 5,
+        "exp": now + 3600,
+        "jti": str(uuid.uuid4()),
+        "video_grants": {
+            "room_join": True,
+            "room": room_name,
+        },
+    }
+    h = b64url(json.dumps(header).encode())
+    p = b64url(json.dumps(payload).encode())
+    signing_input = f"{h}.{p}".encode()
+    sig = hmac.new(API_SECRET.encode(), signing_input, hashlib.sha256).digest()
+    return f"{h}.{p}.{b64url(sig)}"
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_POST(self):
+        if self.path != "/token":
+            self.send_response(404)
+            self.end_headers()
+            return
+
+        length = int(self.headers.get("Content-Length", 0))
+        body = json.loads(self.rfile.read(length) or b"{}")
+        room_name = body.get("room", "voice-room")
+
+        token = make_token(room_name)
+        resp = json.dumps({"token": token}).encode()
+        self.send_response(200)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Access-Control-Allow-Origin", "*")
+        self.send_header("Content-Length", str(len(resp)))
+        self.end_headers()
+        self.wfile.write(resp)
+
+    def do_OPTIONS(self):
+        self.send_response(204)
+        self.send_header("Access-Control-Allow-Origin", "*")
+        self.send_header("Access-Control-Allow-Methods", "POST, OPTIONS")
+        self.send_header("Access-Control-Allow-Headers", "Content-Type")
+        self.end_headers()
+
+    def log_message(self, format, *args):
+        pass  # silence request logging
+
+
+if __name__ == "__main__":
+    server = HTTPServer(("127.0.0.1", 8091), Handler)
+    print("token endpoint listening on 127.0.0.1:8091")
+    server.serve_forever()