🐛(frontend) fix permission store regression

`derive-valtio` was broken by a recent update, which cascaded into
various regressions in the permission store.

Take the opportunity to also refactor how permissions are handled.
The store is now a pure cache with a single writer: every signal
re-reads the browser via `syncPermissions()`, and the browser stays
the only source of truth.

Re-sync triggers, all event-driven (no polling):

* `devicechange`: granting permission reveals device labels/ids, so
  it fires on grant in every browser, including Safari. This
  replaces the previous 500ms Safari polling. Denials are still
  caught by the concurrent `getUserMedia` rejection through
  `notePermissionDeniedFromGum`.
* Window focus: covers the return from the browser or system
  permission UI.
* Permissions API `change` events, where the query is supported.

src/frontend/src/features/rooms/components/Conference.tsx

@@ -41,6 +41,10 @@ import { notifyAutoMutedOnJoin } from '@/features/notifications/utils'
 import { useSnapshot } from 'valtio'
 import { userPreferencesStore } from '@/stores/userPreferences'
 import { userStore } from '@/stores/user'
+import {
+  PERMISSION_BY_DEVICE_KIND,
+  notePermissionDeniedFromGum,
+} from '@/stores/permissions'
 
 export const Conference = ({
   roomId,
@@ -313,6 +317,9 @@ export const Conference = ({
               case MediaDeviceFailure.DeviceInUse:
                 setMediaDeviceError({ error: e, kind })
                 break
+              case MediaDeviceFailure.PermissionDenied:
+                notePermissionDeniedFromGum(PERMISSION_BY_DEVICE_KIND[kind])
+                break
               default:
                 break
             }