feat(roster): gate joins on registered student-ID list

Adds an optional roster.json (set of allowed student IDs) loaded at
startup. add_participant() raises StudentIdNotInRoster when the gate is
on and the supplied id is not present; route returns 403 with a clear
message and logs a roster_reject audit event. Names are NOT checked
against the roster: the join form asks for a current name as a soft
deterrent, but the only hard check is the id.

Includes a deploy/build_roster.py helper that turns class_register
attendance.xlsx into roster.json. Bootstrap env file now exports
QUIZ_ROSTER_PATH; missing file disables the gate (legacy behaviour).

Also drops the user-facing "The cookie is per-device." line from the
join card — students don't need to know the implementation; replaced
with "Enter your registered student ID and your current full name."

.gitignore

@@ -20,6 +20,10 @@ examples/*_pool.json
 # Operators populate it; it stays out of version control.
 /pool.json
 
+# Class roster (real student IDs and names) lives at the repo root on
+# the operator's machine and on the server; never in version control.
+/roster.json
+
 # Codex build leftovers
 .codex_done
 codex_last_message.md