fix: resolve server bugs and unify app-name handling

Bug fixes:
- bbb.js: replace undefined t('defaultWelcome') call that threw a
  ReferenceError when a room had an empty welcome message, breaking
  meeting creation. Default welcome and the guest-invite hint are now
  localised via the i18n system (new "bbb" namespace in de/en).
- auth.js: app name was read from the never-written 'branding' settings
  key, so custom names never appeared in verification emails or the TOTP
  issuer. Now resolved through a shared getAppName() helper.
- auth.js: lowercase the email in the registration duplicate check so
  case-variant duplicates return a clean 409 instead of a 500 (UNIQUE
  violation).
- federation.js: select the user's "language" column so federation
  invite emails respect the recipient's language instead of always
  defaulting to English.
- calendar.js: a set reminder could not be cleared. COALESCE treated an
  explicit reminder_minutes: null as "keep existing"; use a direct
  assignment that distinguishes "omitted" (keep) from "null" (clear).
- index.js / analytics.js: exclude the BBB learning-analytics callback
  from the global 100kb body limit and give it its own 5mb limit, since
  analytics payloads for large meetings can be several MB.

Cleanup:
- Add server/config/appName.js as the single source of truth for the
  app name (admin setting -> APP_NAME env -> 'Redlight') and use it in
  auth, admin, rooms, calendar and federation, replacing the previous
  mix of wrong DB key, direct app_name reads and bare process.env reads.
- Localise the BBB default welcome message in the room owner's language.
- Remove two unused safeAppName variables in mailer.js.

server/routes/auth.js

@@ -13,6 +13,7 @@ import redis from '../config/redis.js';
 import { authenticateToken, generateToken, getBaseUrl } from '../middleware/auth.js';
 import { isMailerConfigured, sendVerificationEmail } from '../config/mailer.js';
 import { getOAuthConfig, discoverOIDC } from '../config/oauth.js';
+import { getAppName } from '../config/appName.js';
 import { log } from '../config/logger.js';
 
 if (!process.env.JWT_SECRET) {
@@ -179,7 +180,8 @@ router.post('/register', registerLimiter, async (req, res) => {
       return res.status(400).json({ error: `Password must not exceed ${MAX_PASSWORD_LENGTH} characters` });
     }
 
-    const existing = await db.get('SELECT id FROM users WHERE email = ?', [email]);
+    // Emails are stored lowercased, so compare lowercased to catch case-variant duplicates
+    const existing = await db.get('SELECT id FROM users WHERE email = ?', [email.toLowerCase()]);
     if (existing) {
       return res.status(409).json({ error: 'Email is already in use' });
     }
@@ -213,12 +215,8 @@ router.post('/register', registerLimiter, async (req, res) => {
       const baseUrl = getBaseUrl(req);
       const verifyUrl = `${baseUrl}/verify-email?token=${verificationToken}`;
 
-      // Load app name from branding settings
-      const brandingSetting = await db.get("SELECT value FROM settings WHERE key = 'branding'");
-      let appName = 'Redlight';
-      if (brandingSetting?.value) {
-        try { appName = JSON.parse(brandingSetting.value).appName || appName; } catch {}
-      }
+      // Load configured app name (admin setting → env → default)
+      const appName = await getAppName();
 
       try {
         await sendVerificationEmail(email.toLowerCase(), display_name, verifyUrl, appName, 'en');
@@ -327,11 +325,7 @@ router.post('/resend-verification', resendVerificationLimiter, async (req, res)
     const baseUrl = getBaseUrl(req);
     const verifyUrl = `${baseUrl}/verify-email?token=${verificationToken}`;
 
-    const brandingSetting = await db.get("SELECT value FROM settings WHERE key = 'branding'");
-    let appName = 'Redlight';
-    if (brandingSetting?.value) {
-      try { appName = JSON.parse(brandingSetting.value).appName || appName; } catch {}
-    }
+    const appName = await getAppName();
 
     try {
       await sendVerificationEmail(email.toLowerCase(), user.display_name || user.name, verifyUrl, appName, user.language || 'en');
@@ -774,12 +768,8 @@ router.post('/2fa/setup', authenticateToken, twoFaLimiter, async (req, res) => {
 
     const secret = new OTPAuth.Secret({ size: 20 });
 
-    // Load app name from branding settings
-    const brandingSetting = await db.get("SELECT value FROM settings WHERE key = 'branding'");
-    let issuer = 'Redlight';
-    if (brandingSetting?.value) {
-      try { issuer = JSON.parse(brandingSetting.value).appName || issuer; } catch {}
-    }
+    // Use the configured app name as the TOTP issuer (admin setting → env → default)
+    const issuer = await getAppName();
 
     const totp = new OTPAuth.TOTP({
       issuer,