feat(roster): gate joins on registered student-ID list

Adds an optional roster.json (set of allowed student IDs) loaded at
startup. add_participant() raises StudentIdNotInRoster when the gate is
on and the supplied id is not present; route returns 403 with a clear
message and logs a roster_reject audit event. Names are NOT checked
against the roster: the join form asks for a current name as a soft
deterrent, but the only hard check is the id.

Includes a deploy/build_roster.py helper that turns class_register
attendance.xlsx into roster.json. Bootstrap env file now exports
QUIZ_ROSTER_PATH; missing file disables the gate (legacy behaviour).

Also drops the user-facing "The cookie is per-device." line from the
join card — students don't need to know the implementation; replaced
with "Enter your registered student ID and your current full name."

tests/conftest.py

@@ -76,6 +76,10 @@ def client(tmp_path, sample_pool):
         admin_password="admin-pass",
         public_url="http://testserver",
         pool_path=str(pool_path),
+        # Point roster at a path that doesn't exist so the gate stays off
+        # for the default suite (existing fixtures use synthetic IDs that
+        # wouldn't be in a real roster).
+        roster_path=str(tmp_path / "roster-absent.json"),
         default_session_id=CANONICAL_SID,
     )
     app = create_app(settings)