fix(server): add missing room creation lock to prevent concurrent join race

Two parallel JOIN_ROOM to a non-existent room could race past each
other during bcrypt.hash, causing the second to overwrite the first
room (password hash lost). The lock was read but never written.

- Create lock promise before bcrypt.hash async boundary
- Release in finally to cover all exit paths (success, MAX_ROOMS, error)
- Concurrent waiters now correctly await existing room creation

server/index.js

@@ -302,21 +302,30 @@ io.on('connection', (socket) => {
                     }
                 }
                 if (!room) {
-                    if (rooms.size >= MAX_ROOMS) {
-                        socket.emit(EVENTS.ERROR, { message: "Server capacity reached" });
-                        return;
-                    }
+                    // Create and store lock before async boundary
+                    let resolveLock;
+                    lockPromise = new Promise(resolve => { resolveLock = resolve; });
+                    roomCreationLocks.set(roomId, lockPromise);
+                    try {
+                        if (rooms.size >= MAX_ROOMS) {
+                            socket.emit(EVENTS.ERROR, { message: "Server capacity reached" });
+                            return;
+                        }
 
-                    const passwordHash = password ? await bcrypt.hash(password, 10) : null;
-                    room = {
-                        passwordHash,
-                        peers: new Set(),
-                        peerIds: new Map(),
-                        peerData: new Map(),
-                        lastActivity: Date.now()
-                    };
-                    rooms.set(roomId, room);
-                    log('ROOM', `Created room: ${roomId.substring(0, 3)}***`);
+                        const passwordHash = password ? await bcrypt.hash(password, 10) : null;
+                        room = {
+                            passwordHash,
+                            peers: new Set(),
+                            peerIds: new Map(),
+                            peerData: new Map(),
+                            lastActivity: Date.now()
+                        };
+                        rooms.set(roomId, room);
+                        log('ROOM', `Created room: ${roomId.substring(0, 3)}***`);
+                    } finally {
+                        roomCreationLocks.delete(roomId);
+                        resolveLock();
+                    }
                 }
             } else {
                 if (room.passwordHash) {