fix: use real client IP for auth rate limiting; preserve lobby across socket disconnect

- Store real client IP from x-forwarded-for on socket for use in JOIN_ROOM
  auth rate limiting (was using proxy IP, breaking brute-force protection)
- Remove clearEpisodeLobbyState() from socket.onclose to preserve lobby
  across brief disconnects; ensureState() recovers lobby + timeout on reconnect
- Lobby is still properly cleared on intentional LEAVE_ROOM and room switch

extension/background.js

@@ -366,7 +366,6 @@ async function connect() {
                 forceSyncDeadline: null 
             });
 
-            clearEpisodeLobbyState();
             
             if (currentRoom) {
                 currentRoom.peers = [];