Join Web Room

Public: admit a visitor and issue their LiveKit token.

This is the enforcement point for every rule in this module — balance, passcode and capacity — because the token is the only thing that actually opens the room. A visitor who skips the page and calls this endpoint directly hits exactly the same checks.