Spectator privacy must be enforced at BOTH REST and WebSocket join

When adding spectating to a real-time game, gating the REST GET /games/:id is not enough: the live board arrives over a WS room join. If the WS join handler treats any non-seated socket as a spectator with no privacy check, anyone who knows the gameId gets full live state, bypassing REST auth entirely. Enforce the SAME visibility rule (public vs invite-token vs participant) in the WS join path. Also: define privacy by the challenge that spawned the game (visibility=invite) rather than a rated/unrated heuristic, so casual public-seek games stay watchable while invite games need the token.