Stabilize room host ownership across rejoins

[coder13]

Summary

• make owner/admin selection deterministic across leave, rejoin, handoff, and empty-room transitions
• preserve the established non-null UPDATE_ADMIN Socket.IO contract while persisting admin: null for empty rooms
• select and persist the next admin for every membership removal, including moderation paths with no notification callback
• reject raw self-kick and self-ban requests so normal departure remains the sole self-removal path
• make simultaneous explicit leaves from two tabs finalize exactly one last-socket departure
• claim the persisted departure with a MongoDB compare-and-set, preventing duplicate cross-process leave side effects
• bind departures to room membership and per-user presence generations; stale claims cannot remove later reconnects or duplicate tabs
• document reconnect, multi-tab, Grand Prix, and downstream invitation authorization semantics

Root cause

The ordinary creator leave/rejoin path already attempted to restore ownership. Its selector was brittle, though: owner restoration required a non-null current admin, while the fallback always chose the first stored active participant. That could select the wrong host for a null-admin room and erase a legitimate active handoff while the owner was absent. The original correction also made empty rooms invoke a callback with admin: null, but established clients dereference admin.id. Explicit leave checked for peer tabs before removing the current socket from the per-user Socket.IO room, allowing two simultaneous leaves to each see the other and strand membership. Process-local departure queues also could not serialize competing Socket.IO processes. Finally, a duplicate socket could arrive while persisted membership was still active, leaving an old departure generation valid unless the new socket durably fenced it.

Authorization, protocol, and concurrency contract

Owner is permanent creator/deletion authority. Admin is the sole active control holder. The active owner reclaims admin; otherwise the active current admin remains, then the first active participant is promoted. Empty rooms persist no admin but never broadcast a null UPDATE_ADMIN payload. Raw self-kick and self-ban are rejected; users leave through the ordinary departure path.

Each actual join or removal advances the room membership revision. Each authenticated duplicate join atomically advances only that user's presenceRevision before acknowledgment; it does not alter membership or admin. Reconnect cleanup captures both revisions. Departure uses a MongoDB conditional update requiring the same active membership and both generations. Exactly one process can claim that departure and emit its metrics/events. A failed claim is terminal and cannot remove a later session. Reconnect grace remains unchanged.

For #187, private-room invitation authority must combine canonical active membership with owner-or-current-admin role checks. Delete authorization alone is intentionally insufficient because an absent owner may still delete a room.

Verification

• focused server Jest suites: 2 suites / 31 tests passed
• full server Jest suite: 15 suites / 100 tests passed
• changed JavaScript files pass ESLint
• git diff --check passes
• full server ESLint remains blocked by a pre-existing server/api.js import-extension violation, outside this PR

Grand Prix is disabled in current runtime configuration; the rejection/no-mutation path is covered, while enabled Grand Prix uses the same model selector but was not browser-tested.

Fixes #153