feat(lotus): load avatar decorations from chat.lotusguild.org (matrix #22)

DECORATION_CDN moves from Nextcloud's public DAV (a PHP session and four
cookies per image, no cache headers) to https://chat.lotusguild.org/decorations,
static files from the versioned avatar-decorations package with a one-week
cache. Pin @lotusguild/element-call-embedded 0.25.0-lotus.26, whose call
tiles accept the new origin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/app/features/lotus/avatarDecorations.ts

@@ -3,8 +3,10 @@
 // of this file at runtime (by regex) instead of re-declaring it, so the two can
 // never drift. If you migrate the CDN, change it here ONLY — keep the
 // `export const DECORATION_CDN = '...'` shape so the sync script can still parse it.
-export const DECORATION_CDN =
-  'https://drive.lotusguild.org/public.php/dav/files/bHswJ9pNKp2t26N/cinny-decorations';
+// matrix #22: static files on chat.lotusguild.org (a versioned package installed
+// by the matrix repo's LXC 106 deploy), not Nextcloud's public DAV. Absolute, so
+// the desktop app and the Element Call fork's origin allowlist both work.
+export const DECORATION_CDN = 'https://chat.lotusguild.org/decorations';
 
 // Runtime base. A deployment can repoint the decorations at a different host
 // without editing the catalog literal above (which scripts/syncDecorations.mjs