* feat: add collaboration rooms with switchable presenter
Rooms are a group of members watching one stage - the live SSH/RDP/VNC
session the current presenter shares. Any member can take over the
stage; the host can invite, force-stop and end the meeting. Stages
reuse session_shares (new room share type), so gating, recording,
expiry and the global sharing toggle all apply unchanged.
* feat: add stage control handoff to collaboration rooms
The presenter or host can grant any member write access to the live
stage and take it back; members can raise a hand to ask. SSH flips the
participant's permission on the live gate; RDP/VNC re-mint the viewer's
join token. Control clears on every stage switch.
* feat: guest links, role invites and invite awareness for collab rooms
- Anonymous guest link per room (host toggles/rotates), followed by
polling the public resolve endpoint; SSH guests join over the terminal
WS with roomGuestToken, guac guests get read-only join tokens
- Invite by role (expands to current members, snapshot semantics)
- Toast when a room you were invited to appears
- Stale stages are cleared lazily when the presenter is gone
- Telnet presenting, expired-tab fallback, documented single-instance
and guac-kick limits
- Tests for the collab routes, room hub, share access and control flip
* fix: keep remote desktop collaboration read-only
* feat: enforce RBAC and harden collaboration features
- Mount requirePermission on hosts/snippets/credentials/automations/AI routes
- Seed and backfill system role permissions on every dialect at startup
- Support personal credential overrides for RDP/VNC/Telnet shared hosts
- Broadcast participant presence in shared terminal sessions
- Make audit log forwarding configurable from the admin panel
- Add role members endpoint and snippet folder sharing
* fix: enforce RBAC across split routes
ZacharyZcR