docs: document /get_token nginx proxy and NPM override risk

LXC 139 NPM proxy host 49 now proxies both /sfu/get and /get_token
to lk-jwt-service (port 8070). Note that re-saving via NPM UI will
overwrite the conf and require re-adding the location blocks.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -67,7 +67,7 @@ matrix/
 - coturn config: `/etc/turnserver.conf`
 - LiveKit config: `/etc/livekit/config.yaml`
 - LiveKit service: `livekit-server.service`
-- lk-jwt-service: `lk-jwt-service.service` (binds `:8070`, serves JWT tokens for MatrixRTC)
+- lk-jwt-service: `lk-jwt-service.service` (binds `:8070`, serves JWT tokens for MatrixRTC at `/sfu/get` and legacy `/get_token`)
 - Hookshot: `/opt/hookshot/`, service: `matrix-hookshot.service`
 - Hookshot config: `/opt/hookshot/config.yml`
 - Hookshot registration: `/etc/matrix-synapse/hookshot-registration.yaml`
@@ -299,6 +299,7 @@ Webhook URL format: `https://matrix.lotusguild.org/webhook/<uuid>`
 - JS transformation functions use hookshot v2 API: `result = { version: "v2", plain, html, msgtype }`
 - The `result` variable must be assigned without `var`/`let`/`const` (QuickJS IIFE sandbox)
 - NPM proxies `https://matrix.lotusguild.org/webhook/*` → `http://10.10.10.29:9003`
+- NPM proxies `/sfu/get` and `/get_token` → `http://10.10.10.29:8070` (lk-jwt-service). Both paths are in `/data/nginx/proxy_host/49.conf` on LXC 139 — **NPM will overwrite these if proxy host 49 is re-saved via the UI; re-add both location blocks after any NPM save**
 - Proxmox sends Discord embed format: `data.embeds[0].{title,description,fields}` — NOT flat fields
 - Transform functions are stored as Matrix room state (`uk.half-shot.matrix-hookshot.generic.hook`) and deployed via `hookshot/deploy.sh`
 
@@ -423,6 +424,8 @@ All custom code lives in `src/app/` on the `lotus` branch of `code.lotusguild.or
 | **GIF picker** | `src/app/components/GifPicker.tsx`, `src/app/features/room/RoomInput.tsx` | Giphy JS/React SDK (`@giphy/react-components`, `@giphy/js-fetch-api`, `styled-components`). API key in `config.json` → `gifApiKey`. GIF button appears next to Send only when `gifApiKey` is set. Sends GIF as `m.image` (fetches blob → `mx.uploadContent` → `mx.sendMessage`). `FocusTrap` handles click-outside / Escape to close |
 | **GIF picker terminal theme** | `src/app/components/GifPicker.tsx` | When `lotusTerminal` is on: dark navy background (`#060c14`), orange dim border, 4px radius, `// GIF_SEARCH` header, injected `<style>` overrides Giphy SDK SearchBar input (dark bg, orange border/focus ring, JetBrains Mono), custom orange scrollbar |
 | **Terminal Design System toggle** | `src/app/state/settings.ts`, `src/app/features/settings/` | `lotusTerminal` boolean setting. When enabled: PTT badge and GIF picker use LotusGuild Terminal Design System aesthetics |
+| **Presence status badges** | `src/app/features/room/MembersDrawer.tsx`, `src/app/features/common-settings/members/Members.tsx`, `src/app/hooks/useUserPresence.ts`, `src/app/components/presence/` | Online/busy/away colored dot badges shown next to verification shields for every member in the room members drawer and settings members panel. Uses `useUserPresence(userId)` hook + `PresenceBadge` component. Members.tsx wraps the hook in a `MemberPresenceBadge` child component to satisfy React hook rules inside `.map()` |
+| **Per-member device sessions panel** | `src/app/components/user-profile/UserRoomProfile.tsx`, `src/app/hooks/useOtherUserDevices.ts` | Collapsible "Sessions" card in user profile popout. Lists all devices for any user with colored shield icons (green=verified, yellow=unverified). Shows per-device "Verify" button that initiates cross-signing SAS emoji verification via `crypto.requestDeviceVerification(userId, deviceId)`. Updates live via `CryptoEvent.DevicesUpdated`. Only shown when cross-signing is active |
 | **LiveKit codec config** | `/etc/livekit/config.yaml` (LXC 151) | `enabled_codecs`: VP8, H264, VP9, Opus, RED for better quality and redundancy |
 
 **Key config values (`/opt/lotus-cinny/config.json`, root — vite copies this to dist):**

landing/index.html

@@ -554,7 +554,7 @@
                 </a>
             </div>
             <p class="also-available">
-                Our Lotus Guild fork of Cinny adds: voice message recording (MSC3245, works E2EE), device verification fix (cross-client SAS emoji + inline cards), incoming call ring + Answer/Decline (DMs &amp; group chats), GIF picker (Giphy), draggable+resizable picture-in-picture call window, poll display &amp; voting, message forwarding, image/video captions, location sharing (map view + send), deleted message placeholders, per-message read receipt avatars (click for full list with timestamps), chat wallpaper in calls, and the Lotus Terminal design theme.
+                Our Lotus Guild fork of Cinny adds: voice message recording (MSC3245, works E2EE), device verification fix (cross-client SAS emoji + inline cards), per-member device session panel with per-device verify buttons, presence status indicators (online/busy/away dots) in member lists, incoming call ring + Answer/Decline (DMs &amp; group chats), GIF picker (Giphy), draggable+resizable picture-in-picture call window, poll display &amp; voting, message forwarding, image/video captions, location sharing (map view + send), deleted message placeholders, per-message read receipt avatars (click for full list with timestamps), chat wallpaper in calls, and the Lotus Terminal design theme.
                 Prefer the unmodified upstream? <a href="https://cinny.in" target="_blank" rel="noopener">cinny.in</a> works with our homeserver &mdash; set it to <code style="font-size:0.8em;color:#e88;">matrix.lotusguild.org</code>.
             </p>