Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Fix webhook event label rendering

fix: move mute overlay out of the gesture detector

Signed-off-by: Natalie Bridgers <natalie@stream.place>

Move the component out of the gesture area to prevent unmute taps from
triggering togglePlayPause.

Signed-off-by: Natalie Bridgers <natalie@stream.place>

bump to go 1.26.5

Go 1.26 deprecates direct access to ecdsa.PrivateKey.D, but the
suggested replacement (PrivateKey.Bytes) rejects non-NIST curves
like secp256k1. go-ethereum's crypto.FromECDSA does the same
32-byte left-padded scalar encoding and supports our curve.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add stream.received webhook event

Smaller OAuth requests

The description under "Show when I'm live on Bluesky" overflowed the
login page on mobile with the keyboard open; move it into a hover
Tooltip like the live-dashboard checkboxes. The row's zIndex: -32
(cargo-culted from the buttons row) would have painted the tooltip
behind the handle input, so drop it — the typeahead overlays it
guarded against carry their own higher zIndexes anyway.

Localize the label and description into all seven supported locales;
it's the text that decides what users grant us, so it shouldn't be
English-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Adds a checkbox to the handle-entry screen (with a preview of the red
Bluesky LIVE avatar ring, since that's the headline thing being declined)
that requests an OAuth scope without the repo?collection=app.bsky.* write
grants. The read-only rpc:app.bsky.* scopes are kept for now; removing
them entirely (in favor of caching profiles/avatars ourselves) is a
follow-up.

Server side, sessions now track their granted scope via oatproxy (bumped
to the fable/dynamic-scopes branch, which accepts subset scopes at PAR
time, reports honest scope in tokens, and adds the RFC 7662
/oauth/introspect endpoint it always advertised):

- statedb.GetSessionByDIDWithScope scans a user's valid sessions for one
holding a grant, newest first; sessions from before scope tracking
count as full grants, so no data migration.
- The director's live-status writes (the red ring) pick a session with
the app.bsky.actor.status grant and quietly skip when the user declined
it everywhere; startLivestream skips the go-live post the same way.

The frontend learns its own scope from /oauth/introspect after login and
locks the "Create Bluesky post" checkbox when posting wasn't granted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>