Update PoliticTalk Jitsi room policy

local/README.md

@@ -31,7 +31,7 @@ The browser may warn about a self-signed certificate. That is expected for local
 
 ## After Editing Overrides
 
-When you edit `local/custom-config.js`, `local/custom-interface_config.js`, or local assets, run:
+When you edit `local/custom-config.js`, `local/custom-interface_config.js`, `web/title.html`, `web/plugin.head.html`, or local assets, run:
 
 ```bash
 ./scripts/local-jitsi-sync.sh
@@ -47,11 +47,30 @@ When you edit `local/custom-config.js`, `local/custom-interface_config.js`, or l
 ## What This Tests
 
 - PoliticTalk branding assets
-- prejoin behavior
+- PoliticTalk browser title, favicon, and in-meeting logo
+- direct room entry after the PgPlatform prejoin/auth step
+- host-only room creation and participant-only Jitsi roles when JWT auth is enabled
 - audio-only policy
 - muted microphone/camera startup
+- host-controlled participant unmute through Jitsi AV moderation
 - toolbar restrictions
 - chat, polls, raise hand, fullscreen, noise suppression
 - E2EE UI availability
 
 Final production verification still happens on the VPS because real WebRTC networking, domain, HTTPS, and future JWT auth depend on the server environment.
+
+## Optional JWT Auth Check
+
+Local Docker Jitsi can be switched into JWT mode when you want to test token-only joins:
+
+```bash
+ENABLE_POLITICTALK_JWT_AUTH=1 \
+POLITICTALK_JITSI_JWT_APP_ID=politictalk-local \
+POLITICTALK_JITSI_JWT_APP_SECRET=replace-with-local-secret \
+POLITICTALK_ROOM_INACTIVE_CALLBACK_SECRET=politictalk-local-lifecycle-secret \
+./scripts/local-jitsi-setup.sh
+./scripts/local-jitsi-start.sh
+```
+
+Use the same app id and secret in `pgapi/.env` so `/events/:id/join-link` returns a URL with `?jwt=...`.
+Use the same callback secret in `pgapi/.env` as `POLITICTALK_JITSI_LIFECYCLE_SECRET`.