List the rooms this credential can reach

Enumeration is DERIVED from use: a key nobody has written under is not a room and is not listed. The visibility filter is applied in SQL and returns exactly the set per-room authorization would admit one at a time — a member reaches all the org's rooms; a grant key or project grant reaches the org's named rooms plus the default rooms of the projects it holds, never a sibling project's; a project service_key reaches only its own. Never lifecycle-gated.