Prove video flows: an e2e suite with a real WebRTC viewer

e2e-edge.sh proves the camera signalling relay round-trips, and says so
honestly - it posts a stub SDP with go2rtc absent and accepts a 503 that
came back from the gateway. But "the offer round-trips" says nothing
about whether anyone would see a picture, and it once read as more than
it was: a stray go2rtc left over from an earlier run answered the stub
with an HTTP 500 and the test still printed ok. Video had never been
shown to flow.

scripts/e2e-camera.sh runs the real backend, the real proxy and the real
go2rtc against the H2C, and scripts/e2e-camera-peer.ts plays the
browser's part with werift: createOffer, relay through the backend,
setRemoteDescription, then ICE, DTLS and SRTP, counting RTP out the far
end. Measured: 124-149 packets and ~119-147 KB of payload within a
second or two. It sends no printer command; the camera is a pull and the
MQTT subscription is passive. It refuses to start if a go2rtc is already
running, and fails if one survives cleanup.

werift is a devDependency for that one file; nothing under src/ imports
it. Its 30 resolved packages were audited against LICENSES.md: 26 MIT,
Apache-2.0, BSD-3-Clause, Unlicense, and one MPL-2.0 (mediabunny), which
the policy allows while we do not edit its files.

Smaller fixes in the same pass:

- e2e-edge.sh now unsets the TURN variables. It asserts TURN is off, but
  sourcing dev-secrets.sh turns it on, and the failure message then
  printed the live Cloudflare username and credential. The new script
  prints only the camera id and a count, never the /stream body.
- the last hardcoded `psql -h localhost` in e2e-edge.sh now uses
  DATABASE_URL, like the rest.

scripts/e2e-edge.sh

@@ -47,6 +47,10 @@ R2_SECRET_ACCESS_KEY="${R2_SECRET_ACCESS_KEY:-e2e}"
 R2_ENDPOINT="${R2_ENDPOINT:-http://localhost:9000}"
 export DATABASE_URL VALKEY_URL EDGE_JWT_SECRET PORT
 export R2_ACCESS_KEY_ID R2_SECRET_ACCESS_KEY R2_ENDPOINT
+# This script asserts TURN is unconfigured (below). Sourcing dev-secrets.sh
+# turns it on, which used to fail the assertion - and print the live
+# credentials in the failure message. Make the assumption true.
+unset CLOUDFLARE_TURN_KEY_ID CLOUDFLARE_TURN_API_TOKEN
 
 WORK="$(mktemp -d)"
 BACKEND_PID=""
@@ -255,7 +259,7 @@ fi
 ok "every printer id this gateway reported mapped to a row"
 
 echo "==> what landed in the database:"
-PGPASSWORD=continuum psql -h localhost -U continuum -d continuum -c \
+psql "$DATABASE_URL" -c \
   "SELECT gateway_printer_id AS gw, status, vendor_state, progress_percent AS pct,
           current_layer || '/' || total_layers AS layers, remaining_minutes AS mins,
           nozzle_temp_c AS nozzle, bed_temp_c AS bed, active_alerts AS alerts,