feat(roster): gate joins on registered student-ID list

Adds an optional roster.json (set of allowed student IDs) loaded at
startup. add_participant() raises StudentIdNotInRoster when the gate is
on and the supplied id is not present; route returns 403 with a clear
message and logs a roster_reject audit event. Names are NOT checked
against the roster: the join form asks for a current name as a soft
deterrent, but the only hard check is the id.

Includes a deploy/build_roster.py helper that turns class_register
attendance.xlsx into roster.json. Bootstrap env file now exports
QUIZ_ROSTER_PATH; missing file disables the gate (legacy behaviour).

Also drops the user-facing "The cookie is per-device." line from the
join card — students don't need to know the implementation; replaced
with "Enter your registered student ID and your current full name."

app/config.py

@@ -29,6 +29,7 @@ class Settings:
     public_url: str = "https://quiz.ahkhan.me"
     log_level: str = "INFO"
     pool_path: str = "./pool.json"
+    roster_path: str = "./roster.json"
     default_session_id: str = "main"
 
     @classmethod
@@ -43,6 +44,7 @@ class Settings:
             public_url=os.getenv("QUIZ_PUBLIC_URL", "https://quiz.ahkhan.me").rstrip("/"),
             log_level=os.getenv("QUIZ_LOG_LEVEL", "INFO"),
             pool_path=os.getenv("QUIZ_POOL_PATH", "./pool.json"),
+            roster_path=os.getenv("QUIZ_ROSTER_PATH", "./roster.json"),
             default_session_id=os.getenv("QUIZ_SESSION_ID", "main"),
         )