Mints a fresh token + unique room on every connect (no ghost agents), and forces TURN relay for firewalls.