feat(directory): add a per-project Lobby cell beside the directory

[iamnbutler]

Second of four stacked PRs for project lobbies (base: #334). Refs #17, #14.

Adds the Lobby Durable Object to the directory's Worker: one per project, named by the shared project ID, at GET /lobbies/<project> behind the same ACE_SECRET. The Directory object, its routes, and its stored data are unchanged. Wire types live in @ace/directory/protocol so hosts import them instead of copying.

• Presence is never stored. Each host replaces its owner's presence; the lobby keeps it in the socket's hibernation attachment and sends everyone the whole list on each change. The attachment holds 2 KiB, so the lobby drops open channels beyond what fits and never fails to serialize.
• Sockets are keyed by host process. hello carries a per-process ID. A reconnect replaces only the same process's stale socket, so an installed and a source Ace on one machine each keep theirs instead of evicting each other.
• Lifecycle events get one seq per project. A host says hello with the newest seq it applied and gets the events after it, then synced. When those events are gone (pruned, from before the lobby's storage, or a first visit) synced carries resync: true and the host reads listings again.
• Retention, per the confirmed decision: an alarm prunes events older than 30 days and beyond the newest 2,000 per project. Age is measured from when the lobby received each event, on its own clock, so a host's clock never affects it. The same alarm runs every 5 minutes and closes sockets silent for 90 s, so a host that slept without closing TCP leaves within about 6.5 minutes; hosts' 30 s pings are auto-answered without waking the object. A host joining a lobby that sat empty re-arms the 5-minute sweep, since the empty lobby's alarm waits for its oldest event to expire.
• Write budget. Durable Objects bill each setAlarm() as one row written, and the free tier allows 100,000 a day. Re-arming the sweep is the lobby's only steady write: 288 a day per project while any host is connected (the sweep was every 60 s, 1,440 a day, before the rebase). Pings, hello, and presence never write; presence lives only in socket attachments. A lifecycle event writes 3 rows (the seq kv key, the row, and its at index entry), and pruning it later writes 2 more. An empty lobby writes one alarm when its last host leaves and one when a host returns.
• A malformed project ID answers 400.
• Migrations: Durable Object SQLite refuses PRAGMA user_version (SQLITE_AUTH in miniflare), so the schema version is counted in the object's version kv key and migrations run in one transaction. seq lives in kv too, so pruning every row never reuses a seq.

Deploying needs only wrangler deploy of services/directory: it adds the LOBBY binding and a v2 migration with new_sqlite_classes: ["Lobby"]. No new secrets. Not deployed by this PR. The live ace-directory Worker's last applied migration tag is v1, read from the Workers scripts API, so v2 applies cleanly.

Smoke-tested with wrangler dev (miniflare): hello/resume/resync at since 0, current, older, and ahead of the log; replay of missed events; presence fan-out and removal on close; ping/pong; eviction of a silent socket after about 120 s; 401 without the secret; the directory's PUT /hosts and GET / unchanged.

After review:

• A malformed ID returned 400.
• Two processes with the same host name both stayed connected, and the same process reconnecting replaced its stale socket.
• A presence listing 200 channels was kept with the 54 that fit.
• An event without at was stored and broadcast.
• The re-armed sweep: one event was stored, then the lobby was left empty for 75 s so its alarm moved out to that event's expiry. A host that then connected and stayed silent was closed as silent 120 s later.

Rebased onto main after #391. The directory's write-minimizing publish is unchanged; this PR only adds the /lobbies route and the Lobby export beside it. Smoke-tested again from the top of the stack with wrangler dev: a host that said hello and then stayed silent was closed as silent 300 s later, at the first 5-minute sweep.

Built in Ace

No. This was built with Claude Code outside Ace by the overnight watcher, because this Mac's Ace Canary is a participant in the two-person study and can't be used for development tonight. See #5.