Implement room creation flow with JWT-based session setup

[wmxscott]

Summary

This PR implements the core room creation flow for Ratifyd, enabling users to start ephemeral interview sessions. When a user clicks "Start Session" on the landing page, the system generates cryptographic keypairs, creates a room, and issues a self-signed JWT that serves as the session token.

Key Changes

• New createRoom() function (src/lib/room/createRoom.ts):

  • Generates RSA signing keypair for JWT signing and nonce proofs
  • Generates RSA-OAEP keypair for receiving encrypted room keys
  • Generates AES-GCM room key for encrypting notes and chat in Yjs
  • Creates unique ownerId and roomId (both UUIDs)
  • Persists all keypairs and keys to localStorage
  • Mints a self-issued owner JWT and navigates to the room via URL fragment
  • Ensures public keys are never exposed in the URL

• Updated LandingPage component (src/components/LandingPage/LandingPage.tsx):

  • Added "Start Session" button that triggers createRoom()
  • Implemented loading state during room creation
  • Added error handling with user-friendly error messages
  • Improved UI with centered layout and descriptive copy

• Comprehensive test suite (src/lib/room/createRoom.test.ts):

  • Validates JWT structure and claims (role, room, iss, jti, exp, iat)
  • Verifies keypair persistence to localStorage
  • Confirms room key is saved under the correct roomId
  • Validates JWT signature using the stored public key
  • Ensures no public keys leak into the URL
  • Tests uniqueness of generated IDs across multiple calls

Implementation Details

• The JWT payload includes room (roomId), role (OWNER), iss (ownerId), and jti (unique token ID)
• All cryptographic material is stored in localStorage keyed by peerId/roomId
• The JWT is passed to the room via URL fragment (#token=<jwt>)
• Self-admission logic is deferred to the useSession hook after YjsProvider initialization

https://claude.ai/code/session_01UASxoGUhQFs33RpjEbwWRB

[wmxscott]

These 3 awaits can probably go in a await Promise.all

[wmxscott]

These 3 awaits can probably go in a await Promise.all as well