feat: session persistence, logout button, TURN HMAC fix; update docs

- Browser mode auto-rejoins saved network on reload (waste_last_network)
- Logout button (⏻) in sidebar clears session; optionally clears identity keypair
- TURN credentials now use HMAC-SHA1 of username (coturn use-auth-secret compatible)
- README: deploy scripts documented, session persistence section, serve-web.sh noted
- FUTURE.md: mark shipped items, add remaining work for daemon TURN + TUI rooms

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

web/src/pages/Onboarding.tsx

@@ -61,16 +61,28 @@ export function Onboarding({ status }: Props) {
     if (inv) setInviteString(inv)
   }, [])
 
+  // Auto-rejoin when adapter is ready and we have saved session state
+  useEffect(() => {
+    if (adapterMode !== 'browser' || status !== 'connected') return
+    const { network: n, netHash: nh } = parseInviteParams()
+    if (n || nh) return // explicit invite — don't auto-join, show form
+    const savedNetwork = localStorage.getItem('waste_last_network')
+    if (savedNetwork) doJoin(savedNetwork, '')
+  }, [adapterMode, status]) // eslint-disable-line react-hooks/exhaustive-deps
+
   function joinNetwork(e: React.FormEvent) {
     e.preventDefault()
-    const name = network.trim()
-    const hash = netHash.trim()
+    doJoin(network.trim(), netHash.trim())
+  }
+
+  function doJoin(name: string, hash: string) {
     if (!name && !hash) return
 
-    // In browser mode: persist anchor URL choice and pass it via localStorage
     if (adapterMode === 'browser') {
       localStorage.setItem('waste_anchor_url', anchorUrl)
       if (nick.trim()) localStorage.setItem('waste_nick', nick.trim())
+      if (name) localStorage.setItem('waste_last_network', name)
+      else localStorage.removeItem('waste_last_network')
     }
 
     if (hash.length === 64 && !name) {