feat(e2ee): Add HKDF E2EE support for Element Call compatibility

Element Call uses HKDF-SHA256 + AES-128-GCM for frame encryption,
while the LiveKit Rust SDK defaults to PBKDF2 + AES-256-GCM.

- Multi-stage Dockerfile builds patched Rust FFI from EC-compat fork
- Generates Python protobuf bindings with new fields
- patch_sdk.py modifies installed livekit-rtc for new proto fields
- agent.py passes E2EE options with HKDF to ctx.connect()
- bot.py exchanges encryption keys via Matrix state events
- Separate Dockerfile.bot for bot service (no Rust build needed)

Ref: livekit/rust-sdks#904, livekit/python-sdks#570

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

e2ee_patch.py

@@ -0,0 +1,14 @@
+"""
+E2EE HKDF constants and helpers for Element Call compatibility.
+
+The patched SDK (via patch_sdk.py + patched FFI binary) adds:
+  - key_ring_size (int, field 5 in proto)
+  - key_derivation_function (int, field 6: 0=PBKDF2, 1=HKDF)
+
+This module provides constants and a convenience function for building
+HKDF-compatible E2EE options.
+"""
+
+# Key derivation function constants matching proto enum KeyDerivationFunction
+KDF_PBKDF2 = 0
+KDF_HKDF = 1