Hosted rooms: the hub's side

Rooms made on the website (hosted_room, migration 0005), the REST routes in
docs/hosted-rooms.md, and the realtime room.* protocol: joining with the
capacity, adult and linked-account rules, seats, numbered messages with
forged senders dropped and a rate limit, closing. The Rooms page lists them,
with a form to make one and the owner's edit and close.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/design.md

@@ -411,7 +411,9 @@ The proxy streams and adds no waiting.
 - Phase 1 (local packs) done: t5de-api, t5de-proxy `internal/products`.
 - Phase 2 (hub identity) under way: accounts, tagline linking, age (vendor-neutral, IMVU's re-checked daily), link
   caps, device sign-in, presence and badge, console, the room channel and the rooms list. Not yet: a sign-in button
-  in the client (the proxy's `signin` command for now), deployment, hosted rooms. The room channel is tested with
+  in the client (the proxy's `signin` command for now), deployment.
+- Hosted rooms (phase 5, docs/hosted-rooms.md): the hub's side is done (rooms made on the website, REST, the
+  realtime `room.*` protocol, tested with fake proxies); the proxy's side is under way. The room channel is tested with
   fake proxies and one live client; two live clients need a second throwaway account.
 - **Stack changed** (2026-10-29, the user's choice): the hub is a Bun monorepo: Elysia API, Better Auth, Drizzle on
   Postgres, Next.js website with Tailwind and shadcn/ui (README). It replaces the first version, in Go. Where this