Rejoin User Call

Re-mint a publish-capable browser JWT for an existing user_call.

Used after a page refresh: the previous CallContactOverlay died with the page, so the LiveKit Room is gone, but voice_sessions is still active. Re-mint the same browser identity (browser:{user_id}:{call_id}) with publish/subscribe so the operator can both hear AND speak again.

Guards:

• call must live in caller's workspace
• call must be status='active'
• call must be mode='user_call' (group/AI rejoin is a different path — bot owns those rooms)
• caller's user_id must match voice_sessions.user_id (only the original caller can rejoin; another workspace member would hijack the mic publish)

LiveKit kicks duplicate-identity participants, so a stale browser that somehow survived the refresh would be evicted by the new join.