Repair mobile auth, join and signaling contracts

[phucnguyen1707]

Summary

• Align mobile login/signup and join lookup with the actual web route contracts, including expiry conversion and confirmation fields.
• Add serialized, single-flight token refresh with epoch checks so old login/refresh completions cannot restore a signed-out session or overwrite a newer account.
• Repair viewer signaling identity and routing using distinct user, participant and SSE subscriber IDs; guard stale callbacks and cleanup.
• Include SSE bearer-header authentication, host liveness heartbeat, and a process-local fail-closed fence when secure-store deletion fails during logout.
• Replace misleading mocks with server-shaped fixtures and add focused lifecycle/concurrency regressions.

Validation

• Full mobile suite: 200 tests passed; mobile TypeScript and ESLint passed.
• Repository lint/typecheck/test: all 23 tasks passed uncached on Node 24.
• Repository format check and 34 script tests passed.
• Android production JavaScript bundle passed with exactly one React 18.3.1 runtime.
• Generated Android screen-share verifier passed earlier in this implementation.
• Independent implementation and bonus reviews completed, including before/after failing reproductions.

Remaining Gates

Draft for code review, not a release claim. No paid EAS build/update, production deploy or store submission was performed.
Native compile, two-device auth/join/media/reconnect smoke, real TURN traversal and iOS broadcasting remain unverified in this environment.
The logout fence protects this process and provider remounts; it does not guarantee persistent deletion across a restart when native secure storage itself fails.