feat: in-app Chat (Matrix JWT SSO) + Drive (embedded oCIS)

- api: matrix-sso module (tuwunel jwt -> login/get_token), POST /matrix/session, GET /matrix/identity, drive controller
- web: /chat full-height Element view, /files Library+Drive tabs, embedded-app frame component
- edge: /hub-sso.html handshake route (origin-pinned CSP), X-Frame-Options strip on files
- oCIS: csp.yaml frame-ancestors app.occupymedia.cc
- server config still required: tuwunel [global.jwt], MATRIX_SSO_JWT_SECRET, oCIS restart

apps/web/src/components/shell/sidebar.tsx

@@ -13,7 +13,7 @@ const NAV: { href: string; label: string; icon: string; external?: boolean }[] =
   { href: "/control-room", label: "Control Room", icon: "video" },
   { href: "/compose", label: "Compose", icon: "compose" },
   { href: "/calendar", label: "Calendar", icon: "calendar" },
-  { href: "https://chat.occupymedia.cc", label: "Chat", icon: "chat", external: true },
+  { href: "/chat", label: "Chat", icon: "chat" },
   { href: "/files", label: "Files", icon: "files" },
   { href: "/archive", label: "Archive", icon: "files" },
   { href: "/inbox", label: "Inbox", icon: "inbox" },