feat(decorations): allow VITE_DECORATION_CDN override; close N127

- avatarDecorations: resolve the decoration CDN base from VITE_DECORATION_CDN at
  runtime, falling back to the DECORATION_CDN literal (kept intact so the sync
  script + tests still parse it). Lets a deploy repoint the CDN without a code
  edit. Guarded for the tsx test runner (import.meta.env undefined there).
- LOTUS_BUGS: close N127 — the denoise dev-injection gap dissolved with the A7
  cutover (no getUserMedia shim is injected anymore; denoise is in-source in the
  EC fork), so there is nothing to inject in dev.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

LOTUS_BUGS.md

@@ -78,7 +78,7 @@ Items from testing, with their fork-level fix path:
 
 ### Calls / Audio
 
-- **N127 — ML denoise shim is never injected in `vite dev`.** The `lotusDenoise` plugin injects only on `closeBundle` (build), so ML noise suppression is silently inactive during local dev. Add a dev-mode injection (`configureServer` / `transformIndexHtml`). Dev-only impact. _Note: this **dissolves entirely** once denoise moves in-source in the fork (A7 fix) — there is then no build-time injection to be missing in dev._
+- ~~**N127 — ML denoise shim is never injected in `vite dev`.**~~ **RESOLVED (dissolved by the A7 denoise cutover).** `vite.config.js` no longer injects a getUserMedia shim at all — the forked Element Call runs ML denoise in-source as a LiveKit `TrackProcessor` (activated by `lotusDenoiseSource=1`), so there is no build-time injection that could be missing in dev. Nothing to fix.
 
 ### 🧨 Encryption / E2EE — ⚠️ EXTREME COMPLEXITY · 🧠 PLANNING SESSION REQUIRED · 👤 SENIOR ENGINEER
 

src/app/features/lotus/avatarDecorations.ts

@@ -6,6 +6,15 @@
 export const DECORATION_CDN =
   'https://drive.lotusguild.org/public.php/dav/files/bHswJ9pNKp2t26N/cinny-decorations';
 
+// Runtime base. A deployment can repoint the decorations at a different host
+// without editing the catalog literal above (which scripts/syncDecorations.mjs
+// and the build read) by setting `VITE_DECORATION_CDN`; otherwise it falls back
+// to DECORATION_CDN. `import.meta.env` is undefined under the tsx test runner,
+// hence the guard. Trailing slashes are trimmed so `decorationUrl` stays clean.
+const envDecorationCdn = (import.meta as unknown as { env?: Record<string, string | undefined> })
+  .env?.VITE_DECORATION_CDN;
+const RESOLVED_DECORATION_CDN = (envDecorationCdn || DECORATION_CDN).replace(/\/+$/, '');
+
 export type AvatarDecoration = {
   slug: string;
   name: string;
@@ -180,5 +189,5 @@ export const ALL_DECORATIONS: AvatarDecoration[] = DECORATION_CATEGORIES.flatMap
 );
 
 export function decorationUrl(slug: string): string {
-  return `${DECORATION_CDN}/${slug}.png`;
+  return `${RESOLVED_DECORATION_CDN}/${slug}.png`;
 }