Add private room join and spectator approval flow

[coder13]

Private rooms need a more flexible approval flow than only sharing a password.

Feedback source:

• Ask to join private rooms.
• Spectators should be able to request access without a password, with owner approval.
• Owners should be able to deny/block repeated spectator requests.

Acceptance ideas:

• Users can request to join or spectate a private room.
• Host/owner receives a request and can approve or deny it.
• Denied users get clear feedback.
• Host can optionally block repeated requests from the same user.