fix(electron): enable mediaDevices on HTTP origins and fix voice auth

- Add --unsafely-treat-insecure-origin-as-secure flag for dev/uat URLs
- Set auto-granted permission handlers for mic/camera in main process
- Adapt useVoiceRoom error message for Electron (no Chrome flags hint)
- Add debug logging to voice-token service and frontend voice API

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

electron/main.js

@@ -1,4 +1,4 @@
-const { app, BrowserWindow } = require('electron')
+const { app, BrowserWindow, session } = require('electron')
 const path = require('path')
 
 const ENV_URLS = {
@@ -15,6 +15,11 @@ function getWindowUrl() {
   return ENV_URLS.dev
 }
 
+// 在 Chromium 启动前将 HTTP 内网地址标记为安全源，
+// 否则 navigator.mediaDevices 在 HTTP 非 localhost 下会被置空
+const insecureOrigins = Object.values(ENV_URLS).join(',')
+app.commandLine.appendSwitch('unsafely-treat-insecure-origin-as-secure', insecureOrigins)
+
 function createWindow() {
   const win = new BrowserWindow({
     width: 1280,
@@ -27,6 +32,7 @@ function createWindow() {
       preload: path.join(__dirname, 'preload.js'),
       contextIsolation: true,
       webSecurity: false,
+      allowRunningInsecureContent: true,
     },
   })
 
@@ -40,7 +46,26 @@ function createWindow() {
   })
 }
 
-app.whenReady().then(createWindow)
+app.whenReady().then(() => {
+  // 自动批准麦克风/摄像头权限请求，无需用户手动确认
+  session.defaultSession.setPermissionRequestHandler((_webContents, permission, callback) => {
+    if (permission === 'media' || permission === 'microphone' || permission === 'camera') {
+      callback(true)
+    } else {
+      callback(false)
+    }
+  })
+
+  // 绕过权限检查，确保 mediaDevices 可用
+  session.defaultSession.setPermissionCheckHandler((_webContents, permission) => {
+    if (permission === 'media' || permission === 'microphone' || permission === 'camera') {
+      return true
+    }
+    return false
+  })
+
+  createWindow()
+})
 
 app.on('window-all-closed', () => {
   app.quit()