feat(host-control-mode): explicit server capabilities for feature detection

Replace the implicit "hostPeerId present ⇒ feature supported" heuristic with an
explicit capabilities list the relay advertises in ROOM_DATA. Cleaner, self-
documenting, and the extensible hook for the planned co-host feature (owner
promotes guests to extra controllers) — a future 'co-host' capability + events
slot in without a protocol bump.

- shared: CAPABILITIES { HOST_CONTROL }.
- server: SERVER_CAPABILITIES advertised in ROOM_DATA.
- background: track serverCapabilities (empty against older relay), serverSupports(),
  thread hostControlSupported through GET_STATUS / GET_CONTROL_MODE / CONTROL_MODE.
- popup: gate the host-control card on the explicit capability instead of hostPeerId.

Backwards-compatible both ways: old relay omits the field → feature stays hidden
(no errors); old client ignores the field. WS test asserts ROOM_DATA advertises
the capability. Adds docs/host-control-mode-TESTING.md (beta-server setup, wss
caveat, two-new-clients note, verification checklist).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/host-control-mode-EDGECASES.md

@@ -24,6 +24,16 @@ reading the code, not yet by watching them behave on each site.
 
 Deferred by decision (see §8): host grace period on disconnect (EC-10).
 
+### Capability detection (forward-compat hook)
+The relay advertises `capabilities: ['host-control']` in `ROOM_DATA`
+(`SERVER_CAPABILITIES` in server, `CAPABILITIES` in shared/constants). The client
+enables host-control UI/behavior only when the flag is present, so the feature
+degrades cleanly on an older relay (absent → off) and old clients ignore the
+field. This is the extensible hook for the planned **co-host** feature (owner
+promotes guests to additional controllers): it will add a `'co-host'` capability
++ events without a protocol bump or breaking older relays/clients. Add new flags
+to `CAPABILITIES` / `SERVER_CAPABILITIES` as features land.
+
 ### Pre-test self-audit (fixed)
 - **Popup remote buttons froze for guests** — in host-only a guest's Play/Pause/SYNC
   click was gated server-side but the button stuck on "Playing"/disabled with no