docs: update CLAUDE.md and README.md for v0.0.1

- CLAUDE.md: add dev:https command, UI Architecture section (design
  system, room layout, screen share, sidebar), new Known Issues (HTTPS,
  chat duplication, self-ban), https:// in trustedOrigins note
- README.md: add dev:https command, features list for v0.0.1, screen
  share mention, HTTPS note for LAN, self-ban protection in API table

CLAUDE.md

@@ -43,8 +43,8 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 │   │   ├── login/ & register/      # Auth pages
 │   │   └── page.tsx                # Landing
 │   ├── components/
-│   │   ├── room/                   # ChatPanel, ModerationPanel
-│   │   └── lobby/                  # WaitingRoom, LobbyManager
+│   │   ├── room/                   # ChatPanel, ModerationPanel (with self-ban protection)
+│   │   └── lobby/                  # WaitingRoom, LobbyManager (scrollable)
 │   ├── lib/                        # prisma, auth, auth-helpers, livekit, redis, rate-limit, lobby-pubsub, chat-pubsub
 │   ├── middleware.ts               # Dev protection (DEV_ACCESS_KEY, ALLOWED_IPS)
 │   └── types/
@@ -106,6 +106,7 @@ Clients → Traefik (LB) → Next.js (x2 replicas) → PgBouncer (pool 25, max 5
 ```bash
 # Dev
 npm run dev                           # Next.js dev server (localhost:3000)
+npm run dev:https                     # Dev server with self-signed HTTPS (media devices on LAN)
 docker compose up -d postgres minio redis pgbouncer  # DB + Storage + Redis + PgBouncer
 npm run lint                          # TypeScript type-check (tsc --noEmit)
 
@@ -182,7 +183,7 @@ DEV_ACCESS_KEY=mySecretKey123
 
 - `better-auth` handles registration/login via `/api/auth/[...all]` catch-all route
 - **Client:** `auth-client.ts` uses `createAuthClient()` without `baseURL` — auto-detects current origin (works from any IP/domain)
-- **Server:** `auth.ts` uses `BETTER_AUTH_URL` for `baseURL` and `BETTER_AUTH_TRUSTED_ORIGINS` (comma-separated) for CSRF origin validation. Without `BETTER_AUTH_TRUSTED_ORIGINS`, auto-detects all machine IPs via `os.networkInterfaces()` + localhost on ports 3000–3010
+- **Server:** `auth.ts` uses `BETTER_AUTH_URL` for `baseURL` and `BETTER_AUTH_TRUSTED_ORIGINS` (comma-separated) for CSRF origin validation. Without `BETTER_AUTH_TRUSTED_ORIGINS`, auto-detects all machine IPs via `os.networkInterfaces()` + localhost on ports 3000–3010, both `http://` and `https://` protocols
 - First admin: first registered user automatically becomes ADMIN (via `databaseHooks.user.create.before` in `auth.ts`)
 - **No `"type"` field in `package.json`** — removed to fix Turbopack ESM/CJS conflict in dev mode. Next.js handles ESM in `.ts/.tsx` automatically
 
@@ -222,6 +223,20 @@ DEV_ACCESS_KEY=mySecretKey123
 | `setup.sh doctor` crashes on .env check | Comments in `.env.example` parsed as variable names by `set -euo pipefail` | Fixed parsing logic |
 | `setup.sh update` runs git pull after stash declined | Missing `else` branch after stash prompt | Fixed control flow |
 | Auth form resets on non-localhost (no error shown) | `trustedOrigins` fallback only had `localhost:3000`, CSRF rejected other origins silently | `auth.ts` auto-allows ports 3000–3010 + `LAN_HOST`; `setup.sh dev` auto-detects LAN IP |
+| Media devices blocked on LAN (not HTTPS) | Browsers require secure context for getUserMedia | `npm run dev:https` (Next.js `--experimental-https`), `setup.sh dev` auto-uses HTTPS |
+| Chat messages duplicated | Race: SSE delivers msg before POST response, seenIds doesn't have real id yet | Check if SSE already delivered the message before replacing optimistic |
+| Ban self crashes room | No server-side check for self-ban/kick | API rejects `targetSessionId === session.user.id`, UI hides buttons for self |
+
+## UI Architecture
+
+- **Design system:** CSS custom properties in `globals.css` via Tailwind v4 `@theme` — surface levels (0–3), accent (indigo), status colors, border tokens
+- **Room layout (Google Meet style):**
+  - Minimal top bar (room name + code)
+  - Video area: `GridLayout` (cameras) or `FocusLayout` (screen share active — carousel + focused view)
+  - Bottom control bar: mic, camera, screen share | chat, lobby, moderation, hand raise | leave/end
+- **Screen share:** auto-detected via `useTracks(Track.Source.ScreenShare)`, switches to focus layout with `CarouselLayout` for camera feeds
+- **Sidebar:** 320px right panel for chat, lobby manager, moderation — stacked, each with own scroll
+- **Components use LiveKit hooks:** `useLocalParticipant`, `useParticipants`, `useRoomContext`, `useTracks`
 
 ## Conventions