Hash seat tokens at rest (security review finding)

Raw seat tokens no longer touch disk or long-lived memory: rooms store
sha-256 hashes, joins compare timing-safely, sessions keep the raw
token they authenticated with only for minting transfer phrases, and
legacy plaintext room files still load (hashed on read). Verified:
rejoin and transfer both work, and the room file contains only
hostTokenHash — no raw token anywhere.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/server/src/store.ts

@@ -10,7 +10,10 @@ export interface RoomMetaLine {
   kind: "meta";
   id: string;
   hostId: string;
-  hostToken: string;
+  /** sha-256 of the host's seat token. Raw tokens never touch disk. */
+  hostTokenHash?: string;
+  /** Legacy plaintext token (pre-hashing files only). */
+  hostToken?: string;
   seed: number;
   createdAt: string;
 }
@@ -18,7 +21,9 @@ export interface RoomMetaLine {
 export interface JoinLine {
   kind: "join";
   name: string;
-  token: string;
+  tokenHash?: string;
+  /** Legacy plaintext token (pre-hashing files only). */
+  token?: string;
 }
 
 export interface StartLine {