v0.12.0 - Recording Upload Improvements and Security Patches

Lots of focus on resolving some security issues and resolving issues surrounding recording uploads.

New Features

• Direct-to-cloud upload for local recordings. Video recorded to a guest's local disk now streams straight to cloud storage in the background
  throughout the session, instead of waiting until the recording stops and uploading everything at once. Cuts down the post-recording wait
  significantly for large sessions.
• "Upload while recording" toggle in the studio header (on by default) to disable the above behavior if preferred.
• Falls back automatically to the previous end-of-session upload behavior when cloud storage isn't configured, or if a direct-to-cloud upload
  attempt fails partway through.

Improvements

• Session data now saves without blocking the app.
• A corrupted session save file gets moved aside instead of silently wiping out every session on restart.
• Stuck video-processing (ffmpeg) jobs now time out (configurable, default 4 hours) instead of hanging a slot forever.
• Added an aggregate per-participant upload cap (configurable, default 100GB) to bound a runaway or malicious uploader.
• Host/moderator tokens no longer leak into server logs.
• Some unbounded internal bookkeeping lists are now cleaned up over time instead of growing forever.
• /pending-guests now accepts the host token as a header instead of only a query param, keeping it out of access logs.

Bug Fixes

• Security: guests could previously bypass the host's approval step and upload recordings directly without ever being admitted to the session —
  closed. Also fixed: uploads continuing well after a session ends, storage limits being skippable, and cloud-upload endpoints not verifying a
  request actually belonged to the session it claimed.
• Fixed a race where opening the same session in two tabs could interfere with an in-progress upload.
• Fixed a rare logging error that could leave a finished upload stuck without ever being processed.
• An interrupted-then-resumed direct-to-cloud upload now finishes with the correct audio/video settings instead of falling back to defaults.
• Cancelling a direct-to-cloud upload now properly cleans up the partial object in cloud storage instead of leaving it stranded.
• Recording a second screen share in one session no longer risks failing to save properly.
• Background upload no longer competes with the recording itself for memory.
• Fixed a bug that could corrupt exported video when screen sharing was restarted mid-recording.
• Fixed a crash-recovery marker getting stuck permanently when a recording crashed before writing its first chunk.
• Fixed a crash affecting nearly every recording/upload action, caused by a leftover debug-logging call.
• Fixed several data-loss/corruption bugs around quick retakes, screen-share restarts, mic issues, and network interruptions during recording.
• Fixed cloud uploads getting stuck when one destination (of several) was unreachable.
• Fixed grid exports occasionally being marked "ready" when the export had actually failed.

Other

• Added CI (automated test runs on push/PR to main).