Device permissions and voice moderation controls

## Summary
Implement device permissions and voice moderation controls for web-desktop voice features.

## Scope
- Handle microphone, speaker, and related browser/device permission states in-product.
- Provide moderator/admin controls for muting, deafening, disconnecting, and speaking permissions as voice features come online.
- Surface clear user feedback for blocked devices, denied browser permissions, and moderator-imposed restrictions.
- Keep moderation and device state understandable during reconnects and device changes.

## Acceptance Criteria
- [ ] Users can understand and recover from denied or unavailable device permissions.
- [ ] Authorized staff can apply and revoke core voice moderation actions.
- [ ] Voice moderation state is visible to the affected user and other participants where appropriate.
- [ ] Device and moderation state remain coherent after reconnects and browser permission changes.

## Operational Notes
- Browser/device behavior varies; the product needs explicit fallback and error handling.
- This issue depends on voice/session state being authoritative before moderation UX is layered on top.

No files or tests are named. Start by locating the authoritative voice/session state and the browser/device permission entry points, then trace reconnect and permission-change handling. Done means denied devices are recoverable, authorized staff can apply and revoke moderation actions, and affected participants see coherent state.

Written by the indexing model from the issue text.