Verify JWT tokens on WebSocket connections via query param. Check room
visibility before allowing access. Block writes from read-only connections.
Add room config endpoint. Require auth for creating new rooms.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
