fix(lotus): soundboard says "not permitted" in audio-only rooms instead of failing silently (#47)

Clips publish as an Unknown-source track. In audio-only rooms the guard
signs a microphone-only token, LiveKit refuses the publish, and since
the fork had already replied {} the host never heard. Check the grants
up front and reply { played: false, reason: "not_permitted" }.

Refs #47

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/lotus/lotusAudioInject.test.ts

@@ -11,6 +11,7 @@ import { of } from "rxjs";
 
 import { type CallViewModel } from "../state/CallViewModel/CallViewModel";
 import {
+  canPublishSoundboard,
   MAX_INJECT_BYTES,
   parseInjectSource,
   startLotusAudioInject,
@@ -258,3 +259,17 @@ test("parseInjectSource rejects oversized or non-buffer audio", () => {
   expect(parseInjectSource({ audio: "not bytes" })).toBeNull();
   expect(parseInjectSource({ audio: new Uint8Array(4) })).toBeNull();
 });
+
+test("canPublishSoundboard: refused by a microphone-only grant (EC #47)", () => {
+  expect(canPublishSoundboard(undefined)).toBe(true);
+  expect(
+    canPublishSoundboard({ canPublish: true, canPublishSources: [] }),
+  ).toBe(true);
+  expect(
+    canPublishSoundboard({ canPublish: true, canPublishSources: [2] }),
+  ).toBe(false);
+  expect(
+    canPublishSoundboard({ canPublish: true, canPublishSources: [2, 0] }),
+  ).toBe(true);
+  expect(canPublishSoundboard({ canPublish: false })).toBe(false);
+});