Serve rooms ("Räume"), which are not courses however the urls read

The account this was built against is in no rooms, so the whole space was
invisible and easy to dismiss as an empty endpoint. It is not empty in
general — the user had rooms until a teacher removed access — and the
UI's naming actively hides the distinction: the sidebar's *Kurse* entry
links to `/rooms/courses-overview` and lists courses, while *Räume* links
to `/rooms` and lists rooms. A url containing `/rooms` identifies neither.

list_rooms and get_room cover the latter. A room holds boards and nothing
else, so get_room lists boards for get_board (which already reports "in
room" from the board context) plus who else is in it. Room boards report
`isVisible`, which the course-page projection does not, so a draft is
named as a draft instead of being offered and then answering 403.

Rooms also go through the crawl, or they would have become the next
blind spot: their boards are indexed, searchable by both the index and
the live-crawl path, diffed by what_changed, and mirrored by the CLI
under the room's name. The board traversal and the snapshot matcher are
now shared between courses and rooms rather than duplicated, which also
fixed the live-crawl path silently not searching pad contents.

The CLI needed no new command — it is file-centric and inherits rooms
through the manifest — but `--course` now accepts a room id, and says so.

`kind` gains 'room'; the column is plain TEXT, so no migration. 112 tests.
Smoke: 42/42 and 44/44 local, 41/41 and 43/43 live.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

local-instance/README.md

@@ -193,6 +193,12 @@ eval "$(./scripts/mcp-env.sh)"      # as the demo student
 cd .. && npm run smoke              # 39 checks against the local instance
 ```
 
+It also builds a **room** ("Raum"): rooms are a separate space from courses,
+and the naming misleads — the sidebar's *Kurse* entry points at
+`/rooms/courses-overview` while *Räume* points at `/rooms`. The fixture adds the
+demo student to one room and leaves a second room without them, so "only the
+rooms I belong to" is testable rather than assumed.
+
 Two things it does **not** do, because the API does not allow them:
 
 - **Teams cannot be created.** The legacy service registers