P15a: hosting a shared session requires a signed-in GM

- The Host control now checks cloudUsername(): when the GM isn't signed in it shows
  "🔒 Sign in to host" (→ Settings) instead of "📡 Host". Players still join as guests.
- Realtime e2e: the GM marks itself signed in before hosting.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

e2e-realtime/seats.spec.ts

@@ -12,8 +12,9 @@ test('a player claims a seat and manages their character; edits round-trip to th
   const gmCtx = await browser.newContext();
   const playerCtx = await browser.newContext();
 
-  // GM: sample campaign + host.
+  // GM: sample campaign + host (hosting requires a signed-in GM).
   const gm = await fresh(gmCtx);
+  await gm.evaluate(() => localStorage.setItem('ttrpg-cloud-user', 'GM'));
   gm.on('dialog', (d) => d.dismiss()); // optional-password prompt
   await gm.getByLabel('Settings').click();
   await gm.getByRole('button', { name: 'Load sample campaign' }).click();