Harden share audio, networking, and security

[Dahhrk]

Summary

• Keep voice on the call track and share only isolated computer sound via AudioWorklet (Windows process-loopback exclusion; Linux PipeWire share sink).
• On Windows without process exclusion, share video only — no endpoint-loopback fallback that could include Pair playback.
• Wait for peer-connection signaling to return to stable before createOffer during share renegotiation; only log computer-sound success when renegotiation actually starts.
• Linux: probe getUserMedia before enumerateDevices, and tear down the temporary PipeWire sink on cancel/generation abort.
• Improve connection recovery with ICE restart, longer ICE gathering, STUN+TURN merge, and peer-left signaling when a roommate disconnects.
• Remove hardcoded GIF API keys (use PAIR_GIPHY_KEY / PAIR_KLIPY_KEY), validate relayed signal payloads, and open only HTTPS external links.
• Prefer hardware-friendly video codecs and milder default bitrates; strip verbose capture/diag noise unless PAIR_DEBUG=1.
• Add npm test coverage for helpers, signaling, and call/share lifecycle guards; stop tracking build logs and addon build junk (keep the shipped .node).

Test plan

• npm test passes
• Voice call + screen share with computer sound: desktop audio shares, call voices do not loop into the share
• Fresh Linux profile / share-without-call: computer sound attaches after permission probe
• Stop sharing during Linux audio setup: default sink is restored
• Older Windows without process-loopback: share is video-only (no endpoint fallback)
• Drop one peer from a room and confirm the remaining peer gets a clean peer-left teardown
• Interrupt network briefly and confirm ICE recovery attempt
• Without GIF env keys, GIF search stays empty instead of using embedded credentials