feat: authorize iOS Hermes accounts and secure session isolation

Sources/Networking/ServerConfig.swift

@@ -29,19 +29,19 @@ struct ServerConfig: Equatable {
             return .failure(.invalidURL(raw))
         }
         if scheme != "https" { return .failure(.notHTTPS(raw)) }
-        var c = components
-        c.path = ""
-        c.fragment = nil
-        guard let base = c.url else { return .failure(.invalidURL(raw)) }
-        // LAN deployment: LiveKit is reachable directly on :7880 (plain ws).
-        // Real domains use wss via same origin. The SDK derives /rtc from the base.
-        let livekit: URL
-        if Self.isPrivateIP(host) {
-            livekit = URL(string: "ws://\(host):7880")!
-        } else {
-            let portSuffix = components.port.map { ":\($0)" } ?? ""
-            livekit = URL(string: "wss://\(host)\(portSuffix)/livekit")!
+        guard components.user == nil, components.password == nil,
+              components.query == nil, components.fragment == nil else {
+            return .failure(.invalidURL(raw))
         }
+        var c = components
+        c.scheme = "https"
+        c.host = host.lowercased()
+        if c.port == 443 { c.port = nil }
+        c.path = ""
+        guard let base = c.url else { return .failure(.invalidURL(raw)) }
+        c.scheme = "wss"
+        c.path = "/livekit"
+        guard let livekit = c.url else { return .failure(.invalidURL(raw)) }
         return .success(ServerConfig(baseURL: base, livekitURL: livekit))
     }