feat(roster): gate joins on registered student-ID list

Adds an optional roster.json (set of allowed student IDs) loaded at
startup. add_participant() raises StudentIdNotInRoster when the gate is
on and the supplied id is not present; route returns 403 with a clear
message and logs a roster_reject audit event. Names are NOT checked
against the roster: the join form asks for a current name as a soft
deterrent, but the only hard check is the id.

Includes a deploy/build_roster.py helper that turns class_register
attendance.xlsx into roster.json. Bootstrap env file now exports
QUIZ_ROSTER_PATH; missing file disables the gate (legacy behaviour).

Also drops the user-facing "The cookie is per-device." line from the
join card — students don't need to know the implementation; replaced
with "Enter your registered student ID and your current full name."

app/db.py

@@ -68,6 +68,9 @@ CREATE INDEX IF NOT EXISTS idx_participants_sid ON participants(sid);
 --   'duplicate_join'       — second-claim attempt on an already-claimed
 --                            student_id; student_id field holds the
 --                            ATTEMPTED id; detail JSON carries IP/UA/name
+--   'roster_reject'        — join attempted with a student_id that is
+--                            not on the registered class list; same
+--                            payload shape as duplicate_join
 CREATE TABLE IF NOT EXISTS student_events (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     sid TEXT NOT NULL,