feat(vcam): use a phone on the network as a virtual camera

SCENES > VCAM pairs a phone through a QR code and turns it into a
handheld camera, after Unreal's Live Link VCAM and Blender's VirtuCamera:

- Android Chrome tracks 6DoF through WebXR immersive-ar; iPhone Safari,
  which has no WebXR AR, tracks rotation through DeviceOrientation, and
  thumb sticks dolly, truck, crane and pan.
- A motion scale (1:1 walk to 1:10000 orbit), smoothing, height and
  horizon locks, hold/clutch and recenter, none of which make the camera
  jump. Focal length and scale-aware depth of field with tap-to-focus.
- The phone shows the app's render as a monitor (newest-frame JPEG pull).
- REC records a take as a version-7 track shot in the selected scene.
- The rig claims the camera through the navigation seam (Cockpit refuses
  it) and holds on any other navigation, scene run or globe input.

Pairing never exposes the app: a loopback-only session request starts a
separate HTTPS listener (VCAM_PORT, default 4174) that serves only the
static phone page and a token-paired relay, and stops after the last
session. Its certificate comes from a local CA built with node:crypto, which
an iPhone can trust once; without it the phone falls back from WebSocket to
HTTPS requests, which iOS allows past a certificate warning.

scripts/qa-vcam.mjs drives it end to end: the real phone page over the
HTTPS fallback, a scripted 6DoF phone, a recorded and replayed take, depth
of field and camera handoff.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015H1iLusTzWpVKitGic2AW8

.env.example

@@ -141,6 +141,12 @@ PORT=4173
 # wildcard entries are ignored.
 # GEV_ALLOWED_HOSTS=
 
+# SCENES › VCAM (phone virtual camera, docs/VCAM.md): the HTTPS listener a
+# paired phone connects to. It starts only when you open a pairing session and
+# serves only the phone page and relay, not the app or its keys.
+# VCAM_PORT=4174
+# VCAM_HOST=0.0.0.0
+
 # Optional: NASA FIRMS live active fires. SERVER-SIDE ONLY (never reaches the
 # browser — the client polls the /api/firms proxy). Free key:
 # https://firms.modaps.eosdis.nasa.gov/api/map_key/