feat(relay): add room admission state

Add a tested relay room layer before introducing QUIC socket handling. The relay
now has a focused place to enforce room membership rules instead of mixing those
rules into the future networking loop.

RoomRegistry accepts validated endpoint hellos, assigns room and peer IDs,
returns server welcome data, limits clients per room, permits only one gateway,
rejects duplicate client MACs, and keeps the room TAP MTU stable once the first
peer joins. A later peer must support the existing room MTU rather than silently
shrinking it after an earlier client may already have configured its TAP adapter.

The networking pieces still need to call this layer from the reliable control
stream and use the resulting peer metadata for datagram forwarding.

Test Plan:
- cargo fmt --check
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings

Refs: PLAN.md relay responsibilities and MAC identity

README.md

@@ -37,6 +37,14 @@ Shared diagnostics and structured logging vocabulary:
 - tunnel counters shared by control messages and runtime diagnostics
 - client connectivity/TAP diagnostics and user-facing status messages
 
+### `lanparty-relay`
+
+Public relay binary and relay-owned room state:
+
+- room admission for clients and gateways
+- one gateway per room, duplicate client MAC rejection, and room limits
+- stable effective room MTU chosen before Ethernet datagrams flow
+
 ## Build
 
 ```bash