feat(roster): gate joins on registered student-ID list

Adds an optional roster.json (set of allowed student IDs) loaded at
startup. add_participant() raises StudentIdNotInRoster when the gate is
on and the supplied id is not present; route returns 403 with a clear
message and logs a roster_reject audit event. Names are NOT checked
against the roster: the join form asks for a current name as a soft
deterrent, but the only hard check is the id.

Includes a deploy/build_roster.py helper that turns class_register
attendance.xlsx into roster.json. Bootstrap env file now exports
QUIZ_ROSTER_PATH; missing file disables the gate (legacy behaviour).

Also drops the user-facing "The cookie is per-device." line from the
join card — students don't need to know the implementation; replaced
with "Enter your registered student ID and your current full name."

app/main.py

@@ -11,6 +11,7 @@ from app.config import Settings
 from app.db import init_db
 from app.pool import PoolValidationError, load_pool_from_file
 from app.room import RoomManager
+from app.roster import load_roster
 from app.routes_admin import router as admin_router
 from app.routes_student import router as student_router
 
@@ -24,6 +25,7 @@ def create_app(settings: Settings | None = None) -> FastAPI:
     @asynccontextmanager
     async def lifespan(_app: FastAPI):
         await init_db(settings.db_path)
+        rooms.roster = load_roster(settings.roster_path)
         try:
             pool = load_pool_from_file(settings.pool_path)
         except PoolValidationError as exc: