zebra-spaces: speakers also subscribe to SFU so they see each other's screens + cameras

Bug: 'speakers publish, listeners subscribe' meant speakers never got
the SFU subscribe leg — which carries every screen + camera publish.
So a host sharing a screen never saw the other speaker's screen, a
late-joining speaker missed any screen already being shared, and
toggling camera made each side see only their own preview.

Fix:
- onRoleEntered: everyone (speaker AND listener) calls sfuSubscribe.
  The subscribe PC carries all incoming kinds: mic + screen + camera.
- onRoleChanged: keep the subscribe alive across role flips instead
  of tearing it down when becoming speaker.
- ontrack mic-handler: if we're a speaker AND we already have a mesh
  peer for the publisher's pubkey, skip the SFU mic track so audio
  only comes through mesh (lower-latency path) instead of doubling.
  Screens + cameras always render regardless of role.

Late-join screens already worked from the SFU side (serveSubscribe
AddTracks every existing publisher into the initial offer); the
missing piece was speakers actually completing the subscribe.

web/zebra-spaces.html

@@ -1260,6 +1260,11 @@ async function sfuSubscribe(){
     for (const [uuid, mm] of members){
       try {
         if (mm.pubkey && hex(unb64(mm.pubkey)) === pubHex){
+          /* if we're a speaker and already have a mesh peer with this
+           * member, mesh carries their audio with lower latency — skip
+           * the duplicate SFU mic. Screens + cameras still come through
+           * because they're handled above. */
+          if (canSpeak(myRole) && peers.has(uuid)) return;
           attachSfuTrack(uuid, ev.streams[0]);
           return;
         }
@@ -1796,14 +1801,17 @@ function applyState(state){
 async function onRoleEntered(){
   if (canSpeak(myRole)) await ensureMicAndUI();
   else updateRoleUI();
+  /* Everyone subscribes to the SFU. Listeners use it for mic+screen+camera.
+   * Speakers use it for screen+camera (and as a backup audio path); the
+   * SFU mic track is suppressed by the ontrack handler when we already
+   * have a mesh peer for that pubkey, so we don't get double audio. */
+  sfuSubscribe().catch(e => logLine('err','sfu subscribe: '+e.message));
   if (canSpeak(myRole)){
     for (const [uuid, mm] of members){
       if (uuid === myUUID) continue;
       if (canSpeak(mm.role)) connectToPeer(uuid, myUUID < uuid);
     }
     sfuPublish().catch(e => logLine('err','sfu publish: '+e.message));
-  } else {
-    sfuSubscribe().catch(e => logLine('err','sfu subscribe: '+e.message));
   }
 }
 async function onRoleChanged(prev, next){
@@ -1813,13 +1821,14 @@ async function onRoleChanged(prev, next){
       if (uuid === myUUID) continue;
       if (canSpeak(mm.role)) connectToPeer(uuid, myUUID < uuid);
     }
-    await sfuUnsubscribe();
+    /* keep sfuSub alive — screen + camera tracks still ride it. The
+     * ontrack handler suppresses SFU mic when mesh is also up. */
     sfuPublish().catch(e => logLine('err','sfu publish: '+e.message));
   } else if (canSpeak(prev) && !canSpeak(next)){
     for (const u of [...peers.keys()]) tearPeer(u);
     dropMic(); muted = false;
     await sfuUnpublish();
-    sfuSubscribe().catch(e => logLine('err','sfu subscribe: '+e.message));
+    /* still subscribed — listener role needs the same incoming streams */
   }
   updateRoleUI();
 }
@@ -2406,8 +2415,8 @@ logLine('', 'ready — pick a handle, type a rendezvous code, enter the space');
 
 <footer style="margin:2.2rem auto 0;font-size:0.65rem;color:#999;line-height:1.7;word-break:break-all;font-family:monospace">
   <span id="pi-seal" style="color:#777;cursor:default;user-select:none" title="">page integrity</span> &nbsp;·&nbsp; built <span class="stamp-date">2026-06-02</span><br>
-  md5 <span class="stamp-md5">bcedfb60e6bcfaedb68a6e765e07147a</span><br>
-  sha256 <span class="stamp-sha">e05988eba4d8be995628c3875f7e3e1daca1f5fed54e571517ead8fcecbb288b</span><br>
+  md5 <span class="stamp-md5">e1c393db6371901f9dd2bc5f30195cf1</span><br>
+  sha256 <span class="stamp-sha">b7c89d66d504eb2765bac6c128f31d07df03bc7f4309e4f6173811212510bb71</span><br>
   <span style="color:#bbb">hashes are of this page with these two fields zeroed — to verify, blank them and re-hash</span><br>
   <span style="color:#bbb">one self-contained file — <strong>save a copy</strong> and verify against these hashes; point at your own servers with ?signal= and ?turncred=, or <a href="host-your-own.html" style="color:#999">host your own community</a></span>
 </footer>