chore(media-server): log PeerConnection state for both peers

ICE state alone doesn't cover DTLS handshake failures; overall
PeerConnectionState does. Adding the log gives us a signal for why
inbound Meta-side connections transition to closed shortly after ICE
connects — useful for diagnosing the inbound-audio path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

enterprise/media-server/internal/peer/agent_peer.go

@@ -162,6 +162,10 @@ func NewAgentPeer(cfg *config.Config, id string, role PeerRole, iceServers []web
 		}
 	})
 
+	pc.OnConnectionStateChange(func(state webrtc.PeerConnectionState) {
+		slog.Info("agent peer: connection state changed", "peer_id", id, "state", state.String())
+	})
+
 	// Create an SDP offer for the agent's browser.
 	offer, err := pc.CreateOffer(nil)
 	if err != nil {

enterprise/media-server/internal/peer/meta_peer.go

@@ -144,6 +144,16 @@ func NewMetaPeer(cfg *config.Config, sdpOffer string, iceServers []webrtc.ICESer
 		}
 	})
 
+	// Log overall peer connection state (covers DTLS + ICE + signaling).
+	// This catches failures that don't surface via ICEConnectionState alone,
+	// such as DTLS handshake errors.
+	pc.OnConnectionStateChange(func(state webrtc.PeerConnectionState) {
+		slog.Info("meta peer: connection state changed", "state", state.String())
+	})
+	pc.OnSignalingStateChange(func(state webrtc.SignalingState) {
+		slog.Debug("meta peer: signaling state changed", "state", state.String())
+	})
+
 	// Perform SDP negotiation based on call direction.
 	var sdpResult string
 	if sdpOffer != "" {