🔒️(backend) rely on backend to allow participant update their metadata

Introduce toggle-hand and rename endpoints in RoomViewSet,
secured with LiveKit token authentication.

Remove direct permission for clients to update their own metadata
via LiveKit tokens to prevent spoofing (e.g. faking admin status).

Proxy participant metadata updates through the backend to enforce
proper validation and authorization.

Signed-off-by: lebaudantoine <lebaud.antoine131@gmail.com>

src/backend/core/utils.py

@@ -96,7 +96,7 @@ def generate_token(
         room=room,
         room_join=True,
         room_admin=is_admin_or_owner,
-        can_update_own_metadata=True,
+        can_update_own_metadata=False,
         can_publish=bool(sources),
         can_publish_sources=sources,
         can_subscribe=True,