fix(rooms): reclaim empty rooms on public sites

[TNTcraftHIM]

Public sites can exhaust the four-digit room-code pool because retained room authority has no default expiry. Add an opt-in empty-room timeout and reclaim the oldest eligible empty room when capacity is exhausted. Connected Hosts and Viewers retain their rooms through sharing, pause and idle chat; the existing reconnect grace protects early reclamation.

The default remains disabled, including App Local and the internal deployment. The public Demo will use ROOM_EMPTY_TIMEOUT_SECONDS=3600. Retirement reuses the storage-first deletion and signaling cleanup owners; no protocol or SQLite schema changes are required.

Validation: Web type-check, 81 test files / 1372 tests and production build; Go core tests, formatting, vet and target builds; documentation/project hygiene; access-privacy gate; live server expiry/occupied-room check. Regression coverage includes all 9000 codes, restart, stale credentials, reconnects, revocation and atomic storage failure. Native device behavior is unchanged; physical macOS/Linux acceptance retains its documented limits.

Release notes

中文

这是一次面向公共站点的维护更新，解决长期保留的空房间占满房间号的问题。

• 管理员可配置空房间回收时长；号码用满时，优先回收过期空房间，再按创建顺序回收符合条件的空房间。在线分享、暂停和聊天均会保留。
• 房间号确实已用满时，界面会显示更明确的提示。
• 自动回收默认关闭。公共站点可设置 ROOM_EMPTY_TIMEOUT_SECONDS=3600，在房间连续无人在线一小时后回收；未配置的站点保持原有行为。

English

This maintenance release helps public sites avoid exhausting room codes through indefinitely retained empty rooms.

• Operators can configure an empty-room timeout. When all codes are in use, allocation reclaims expired empty rooms first, then the oldest eligible empty room. Connected sharing, paused sessions and chat remain protected.
• Capacity errors now provide clearer guidance when no room code is available.
• Automatic reclamation is disabled by default. Public sites can set ROOM_EMPTY_TIMEOUT_SECONDS=3600 to retire rooms after one continuous hour with no connected participants. Unconfigured sites retain their existing behavior.