Serve T5DE-hosted rooms; a second client instance's own data

Hosted rooms (internal/hosted): room calls for them answered here, their IMQ queues served (a new
proxy.IMQRouter hook takes them out of subscriptions to IMVU), chat relayed through the hub's
WebSocket (hub.Client gains Send, OnRoom and OnConnect), the room list extended, room products
checked against the real owner, and anything else naming a hosted room kept from IMVU.

T5DE_INSTANCE gives a second client's proxy its own data folder and log.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

internal/products/products_test.go

@@ -417,3 +417,24 @@ func TestSavedOutfits(t *testing.T) {
 		t.Fatalf("outfits %s", body)
 	}
 }
+
+func TestHostedRoomProducts(t *testing.T) {
+	h, _ := newHarness(t)
+	h.do("POST", "https://secure.imvu.com/api/xmlrpc/client.php", call("test.avatarInfoForLogin2"), false, false)
+	h.p.HostedOwner = func() int64 { return 7 } // the fake IMVU answers as user 7
+	auths := xmlrpc.Struct{{Name: "auths", Value: []xmlrpc.Value{
+		[]xmlrpc.Value{"userId", "productId"}, []xmlrpc.Value{int64(HostedOwnerID), int64(500)}}}}
+	_, body := h.do("POST", "http://client-dynamic.imvu.com/api/xmlrpc/client.php", call("test.authorizeProducts2", auths), true, false)
+	asked := h.imvu.asked["test.authorizeProducts2"]
+	if len(asked) != 1 || strings.Contains(asked[0], "2100000000") {
+		t.Fatalf("IMVU was asked %q", asked)
+	}
+	r, err := xmlrpc.ParseResponse(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	rows := r.Params[0].([]xmlrpc.Value)
+	if first := rows[1].([]xmlrpc.Value); first[0] != int64(HostedOwnerID) || first[2] != int64(500) {
+		t.Fatalf("answer %v", rows)
+	}
+}