Add private room join and spectator approval flow

Private rooms need a more flexible approval flow than only sharing a password.

Feedback source:
- Ask to join private rooms.
- Spectators should be able to request access without a password, with owner approval.
- Owners should be able to deny/block repeated spectator requests.

Acceptance ideas:
- Users can request to join or spectate a private room.
- Host/owner receives a request and can approve or deny it.
- Denied users get clear feedback.
- Host can optionally block repeated requests from the same user.