fix(calls): read the EC iframe document defensively when the widget failed to load

When the Element Call frame's navigation fails (offline, blocked) it becomes a
cross-origin error page and `iframe.contentWindow.document` throws a
SecurityError. Every DOM-driven call hook (CallControl selectors, deafen DOM
fallback, useCallSpeakers/useRemoteAllMuted observers, CallEmbed theme
injection) read it unguarded, so the moment the 25 s load watchdog fired the
page logged a burst of uncaught SecurityErrors. Reproduced headless by aborting
the EC index request. One `getCallDocument()` helper now treats "can't read" as
"not loaded yet"; the watchdog overlay itself was already correct.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA

src/app/plugins/call/utils.ts

@@ -116,3 +116,19 @@ export function getCallCapabilities(
 
   return capabilities;
 }
+
+/**
+ * The EC iframe's document, or undefined when it cannot be read. The widget is
+ * same-origin, but when its navigation fails (offline, blocked) the frame
+ * becomes a cross-origin error page and `contentWindow.document` THROWS a
+ * SecurityError — which surfaced as page errors (and a React "Should not
+ * already be working" cascade) from every DOM-driven call hook the moment the
+ * load watchdog fired. Treat "can't read" the same as "not loaded yet".
+ */
+export const getCallDocument = (iframe: HTMLIFrameElement): Document | undefined => {
+  try {
+    return iframe.contentDocument ?? iframe.contentWindow?.document ?? undefined;
+  } catch {
+    return undefined;
+  }
+};