Server on an isolate, dedicated server binary, room -> server (proto 5)

- serve(Map config, events) is the one server entrypoint: the app
  hosts it via Isolate.spawn (crash surfaced on the Host card, logs
  forwarded as [server]); bin/server.dart is the dedicated server,
  compiled into the bundle as watch-together-server. --headless gone.
- Host identity via a per-hosting hostKey in hello, replacing the
  loopback heuristic.
- Rename room -> server across code, files and wire (t:"state",
  /health name); protocol bumped to 5.
- CI compiles the server binary; isolate smoke tests in server and
  desktop suites. Docs updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/watch-together.service

@@ -1,10 +1,22 @@
+# Dedicated watch-together server (no display needed).
+# Install: unpack the release tarball to /opt/watch-together (the unit only
+# uses the watch-together-server binary in it), copy this file to
+# /etc/systemd/system/, then `systemctl enable --now watch-together`.
+# Flags: --port <n> (default 8080), --secret <password> (empty = open
+# server, anyone who can reach the port can join), --name, --media <file>,
+# --advertise-host <host>, --config <file.yaml|json>. See README.
+# Prefer --config with a root-only file over --secret here: unit files and
+# process lists are readable by other users.
+
 [Unit]
-Description=watch-together headless server
-After=network.target
+Description=watch-together dedicated server
+After=network-online.target
+Wants=network-online.target
 
 [Service]
-ExecStart=/opt/watch-together/server --port 8080
+ExecStart=/opt/watch-together/watch-together-server --port 8080 --secret change-me
 Restart=on-failure
+DynamicUser=true
 NoNewPrivileges=true
 
 [Install]