Prevent historical meeting-command replay after room re-enrollment

Follow-up to the verified Flå production incident and recovery: re-created cmd-fla used deliver_policy=all on an indefinitely retained limits stream, replaying 589 old commands from June onward; slow sequential handling with 30-second ACK deadlines caused more than 6,000 deliveries and repeated historical meeting start/pause/resume/stop/reset actions. Targeted purge, reboot and normal orphan stop restored idle state. No source patch or release has been performed. Evidence and reuse: local-streamer/src/nats_sub.rs::ensure_consumer defaults deliver-all; run dispatches every envelope before ACK and has no command-ID deduplication, expiry or progress ACK. cloud-router/src/nats.rs retains streaming.cmd.> indefinitely; deleting a box/room deletes its durable consumer but leaves subject history. Protocol docs require command-ID idempotency. local-streamer/src/session.rs resumes saved sessions at boot; flushing the broker alone does not clear in-process buffers or persisted sessions. Scope: establish a safe explicit starting-position/re-enrollment policy and idempotent command handling so obsolete meetings cannot replay. Preserve legitimate short-disconnection delivery and restart recovery, isolate rooms, and do not simply switch every reconnect to deliver-new or impose clock-sensitive expiry without defining behavior. Review long-running dispatch/ACK handling to avoid repeat side effects. Reuse existing consumer, protocol, recovery and tests; no new dependencies or production deployment without agreement. Acceptance: red-green regression with isolated real NATS reproduces retained-history delivery after consumer recreation; re-enrollment cannot execute historical lifecycle/reset commands; duplicate/redelivered commands do not reapply side effects; legitimate offline commands and resume/restart paths retain defined tested behavior; other-room consumers/history remain intact. Rust fmt/check/test and relevant Clippy pass. Plan policy changes before implementation. Production recording integrity issues observed during recovery are not certified repaired by this work.