feat(media): deploy Element Call fork + optimize LiveKit quality

- Deploy self-hosted Element Call at call.sunbeam.pt with SSO login
- LiveKit: VP9 > AV1 > H.264 codec preferences, Opus stereo
- LiveKit: congestion_control.allow_pause=false, larger NACK buffers
- LiveKit: resources bumped to 2Gi/4CPU for VP9 SVC
- Proxy: add call.* route, TLS cert SAN for call.sunbeam.pt

base/media/kustomization.yaml

@@ -8,6 +8,7 @@ resources:
   - vault-secrets.yaml
   - livekit-alertrules.yaml
   - lk-jwt-service.yaml
+  - element-call.yaml
   # livekit-servicemonitor.yaml disabled — LiveKit runs on hostNetwork and port 6789
   # is not reachable from Prometheus due to host firewall. Open port 6789 on the host
   # or add an iptables rule, then re-enable.