TOP: friends and family can join in seconds - pick a username in the app (no forge account), then queue and drive #33

Owner, 2026-10-20 20:40Z: "i want to send this to my friends and family asap. anon should have read. users should be able to create an account to control. the account could be entirely within this app. it doesnt need to sync to the platform identity. just let users enter a username. this will allow us to ban usernames or IPs or other fingerprinting methods but then also adds some identity."

State: the production app is now PUBLIC (steward, 20:45Z) - anonymous visitors get the app (200) while the repo stays private. Watching works without any account.

Done:

1. "Join" asks only for a username (3-20 chars, letters/numbers/_-, unique, case-insensitive, blocked-words checked). No email, no password; the app issues a long random session token in an HttpOnly, Secure, SameSite=Lax cookie (365 days). Same browser = same user. Optional later: a 4-digit PIN to claim the name on another device.
2. App-local users live in the app's own store (survives restarts). Queue, drive and chat use this identity. The forge identity (signed x-forge-identity, verified) is still honored and makes the repo owner the admin - the owner never needs an app account.
3. Bans hit username + IP + a light fingerprint (cookie id + user agent hash); a banned visitor can still watch but cannot join, chat or queue; creating a new name from a banned IP is refused. Mute by username. All on /admin (#12, #13 build on this identity).
4. Rate limits: max 3 new usernames per IP per hour; chat and commands per user as in #13/#11.
5. Remove the dependency on forge sign-in for driving: the "Sign in to take control" button becomes "Join to take control".
6. Mobile first (#32): Join is one field and one button.
7. Tests: a fresh browser joins and queues; a duplicate name is refused; banned IP cannot join under a new name; the owner signed in to the forge is admin without joining; forged identity header ignored.