Minimize avoidable chat and signaling metadata disclosure

[Copilot]

Reduce plaintext metadata exposed by chat and signaling without breaking existing payload contracts. Document what remains visible despite E2EE.

• Count-only presence: Add getParticipantCount() and countOnly=true; migrate UI presence checks and SDK call preconditions. Preserve the legacy identity-list API and accept older servers’ list responses.
• Payload and log minimization: Explicitly select join fields and envelope headers (version, strategy, data), preserving opaque strategy data. Remove identifiers from join/channel diagnostics.
• Contract coverage: Add exact-field assertions for socket payloads, relay acknowledgments, count-only responses, legacy compatibility, and identifier-free logging.
• Privacy documentation: Record the before/after inventory, remaining routing and traffic-pattern exposure, ephemeral-ID guidance, and optional authenticated-padding trade-offs.

const count = await chat.getParticipantCount(); // No participant IDs requested

• Fixes Audit and minimize avoidable metadata leakage #496

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud