feat(slides): Live broadcast

[niemes]

Live slide broadcast - present any deck online, no accounts for viewers

This implements live broadcasting for bento/slides: the presenter's current slide syncs to any number of viewers in near-real-time over the existing collab relay. Viewers need no account, no write access, no collaboration keys. The broadcast copy of the file is the whole capability.

What it adds

• Share menu → "Save broadcast copy…" — exports a standalone viewer file of the current deck. It boots into a locked present-follow mode and runs the real renderer on its own copy of the document, so viewers see the same slides, transitions, and morphs as the presenter.
• Speaker view → Broadcast toggle — arms the broadcast (off by default, every show), shows the live viewer count, and syncs navigation, laser pointer, and black screen.
• The relay stays blind — the nav channel carries only a slide number (plus laser/black control), never content. The relay never holds a document.
• No secrets in files or URLs — the room name and the connect token are both derived (sha256) from the presenter's signing key, so a broadcast copy carries no keys and a shareable link carries no token.
• Write is impossible — control frames are ECDSA-signed and verified by the relay (trust-on-first-use key pinning per broadcast room); broadcast copies carry no keys at all.
• The format stays additive — collab.broadcast is an optional field; existing files open unchanged.

The two sharing cases

Not hosted — the file is the link. A deck without a hosting URL exports a pure snapshot copy embedding only the room name and relay. Give the file to viewers: when you start presenting and arm the broadcast, every open copy connects straight to the room derived from your signing key and follows — nothing to share, no URL involved.

Hosted — a URL instead of the file. A deck with a hosting URL (Document properties → meta.hostClient) exports a copy that additionally carries reader credentials and joins the deck's collab room as a live reader replica, so slide content updates in real time as the deck is edited mid-show. The speaker view shows a full viewer URL (host?room=<name>) with a Copy button, and the same hosted copy can be re-pointed at any presenter's room via ?room= — a replacement presenter takes over without re-exporting files.

Laser pointer

The presenter laser got some work in this pass:

• Draws only while the mouse is held down -> moving the pointer without a click never draws; a stroke starts on pointerdown over the slide and ends with a clean off frame on pointerup. For performance with the sync worker and it is also a more natural behavior.
• A longer, smoother trail -> an ~0.8s fading sweep built from tapered quadratic segments (halo + core), so the tail reads as a sweep rather than a smear.
• No text selection while drawing -> with the laser armed, dragging on the slide can never select text (user-select: none on the slide subtree). Text selection is not broadcasted, so endup as visual noise for the speaker.
• Synced to viewers -> stroke points travel as slide-fraction coordinates (~30fps), so the audience sees the same dot and trail and including a fix for ghost strokes between mouse releases.
• Added an svg based icon, because U+1F7D2 char dont render on macOS.

Relay

server/sync-worker gains broadcast control-frame handling (nav/laser/black with signature verification, per-room TOFU key pinning, lastNav/lastBlack replay for late joiners, presence counts).
The relay must be deployed (wrangler deploy).

Verification

• node scripts/test-nav.mjs — 15/15: unsigned, forged, and member-key frames dropped; valid frames fanned; lastNav replayed ahead of live frames; presence rises on connect and falls on close; rate limiter intact; laser/black security.
• tsc -b clean, npm run build:single OK; no CRDT changes (scripts/test-sync.ts untouched).
• Manual two-tab session: the copy follows slide-for-slide with transitions, a mid-show joiner lands on the current slide, disarm quiets the feed, stale copies clamp instead of crashing.
• New UI strings in all 8 locale catalogs.

Checklist

• npm run build:single succeeds (from slides/)
• Ran node scripts/test-sync.ts if I touched slides/src/sync/
• New UI strings added to every catalog in slides/src/i18n/
• Document format changes are additive and backward-compatible
• Did not bump the version or cut a release (maintainers sign releases)

[niemes]

Small note for local testing, the sync worker variable DEFAULT_SYNC_HOST needs to be changed, its hardcoded in online.ts (maybe we could use an env variable, would be easier to config for people self hosting the worker)