feat(video+desktop): camera capture, video UI, E2E AEAD wiring, test fixes

Blockers 4 & 5: browser getUserMedia → JPEG IPC → Rust I420 pipeline;
remote video strip renders decoded frames via canvas; EncryptingTransport
wraps QuinnTransport so WZP AEAD is applied to all media (C2 fix).

Test fixes: HandshakeResult.session destructuring across relay/client/crypto
integration tests; video_codecs field added to all CallOffer/CallAnswer
structs; wzp-video pipeline_roundtrip integration tests added.

PRD docs: five Kimi-ready specs for E2E encryption, Android NDK 0.9 migration,
quality upgrade flow, wire-format hardening, and clippy debt.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

crates/wzp-proto/src/packet.rs

@@ -574,6 +574,10 @@ pub enum SignalMessage {
         /// Protocol versions this client supports (default [2]).
         #[serde(default = "default_supported_versions")]
         supported_versions: Vec<u8>,
+        /// Video codecs supported by the caller, in preference order.
+        /// Absent on old clients (treated as video-incapable).
+        #[serde(default, skip_serializing_if = "Vec::is_empty")]
+        video_codecs: Vec<crate::CodecId>,
     },
 
     /// Call acceptance (analogous to Warzone's WireMessage::CallAnswer).
@@ -588,6 +592,10 @@ pub enum SignalMessage {
         signature: Vec<u8>,
         /// Chosen quality profile.
         chosen_profile: crate::QualityProfile,
+        /// Video codec chosen by the callee (None = video declined or peer incapable).
+        /// Absent on old clients (treated as no video).
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        video_codec: Option<crate::CodecId>,
     },
 
     /// ICE candidate for NAT traversal.