feat(media): deploy lk-jwt-service for Matrix Element Call

Bridges Element Call to LiveKit by exchanging Matrix OpenID tokens for
LiveKit JWTs. Shares API credentials with livekit-server via the
existing VSO secret (removed excludeRaw so raw fields are available).

base/media/kustomization.yaml

@@ -7,6 +7,7 @@ resources:
   - namespace.yaml
   - vault-secrets.yaml
   - livekit-alertrules.yaml
+  - lk-jwt-service.yaml
   # livekit-servicemonitor.yaml disabled — LiveKit runs on hostNetwork and port 6789
   # is not reachable from Prometheus due to host firewall. Open port 6789 on the host
   # or add an iptables rule, then re-enable.