Seat tokens hashed on the ledger, inputs written as they arrive, codes checked against the disk

A seat line now carries the SHA-256 of its token, compared in constant
time; the token itself goes once to the browser that earned it. Ledgers
written before this are read once more by their raw token, and
deploy/hash-tokens.ts rewrites them in place. Each submitted move is its
own ledger line, so a half-written turn survives a restart. A room code
is never reissued over an evicted room's ledger. Only the host seats a
bot. The deploy gate compares against the gallery view, so no token
leaves the ledger for it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0141G6xqLeNRYEtviLWSB5Up

src/routes/join/[code]/+page.svelte

@@ -180,7 +180,7 @@
 		</ul>
 		{#if !watching}
 			<div class="ways">
-				{#if r.seats.length < r.size}
+				{#if r.seats.length < r.size && room.isHost}
 					<button type="button" class="quiet" onclick={() => room?.addBot()}>Seat a bot</button>
 				{/if}
 				{#if room.isHost}