Add scoped QR-hosted FableLoom sessions with half-duplex protagonist voice (#5383)

[atomantic]

Closes #5383

Summary of Changes

• Preflight Readiness & HTTPS Verification: Checks TLS/HTTPS requirement for Web Audio recording, start scene validity, STT/TTS configuration, and hold scene audio safety before session creation.
• High-Entropy Scoped Tokens & Fragment URL: Generates 256-bit cryptographically secure session tokens stored strictly SHA-256 hashed. Join URLs use fragment format (#session=...&token=...) so credentials never appear in server request logs or referrers.
• Dedicated Socket.IO Namespace (/fableloom-hosted): Scopes guest mobile devices strictly to their authorized session room without granting PortOS admin credentials.
• Half-Duplex Turn Architecture: Enforces LISTENING -> THINKING -> SPEAKING -> LISTENING contract. Utterances sent outside the listening phase are rejected. Speech completes before story graph transitions are committed.
• Runtime Live Conversation Gate: Revalidates that audience connection is active, playback mode is decision, playback phase is hold, protagonist is off-screen, and hold loop audio contains no blocking dialogue or foreground sound effects.
• Audio Output Target Routing: Supports routing protagonist character voice output to host computer speakers or audience phone.
• Client UI & Mobile View: Added LoomHostedSessionModal for QR presentation and readiness management, FableLoomHostedJoin mobile push-to-talk interface, and integrated live turn indicators into LoomPlayPanel.