docs+test: move KNOWN_LIMITATIONS to docs/, add everyone-mode regression test, co-host plan

- Move KNOWN_LIMITATIONS.md → docs/KNOWN_LIMITATIONS.md (+ fix SECURITY.md link).
- WS test: in default 'everyone' mode a non-host guest can still drive
  play/pause/seek/force-sync/episode-lobby — proves host-control OFF == unchanged
  behavior.
- docs/host-control-mode-COHOST-PLAN.md: plan for multi-controller (owner grants
  drive rights to several co-hosts), built on the capabilities hook; covers the
  gate generalization, roles, backwards-compat, edge cases, and a separate
  large-room (510-peer) scaling track.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/test-server-ws.mjs

@@ -73,6 +73,21 @@ try {
     close();
     resetConnectionRate();
 
+    // --- Default 'everyone' mode does NOT gate anyone (host-control OFF = unchanged) ---
+    // Confirms that with host-only off, a non-host guest can still drive every
+    // room-moving event exactly like before the feature existed.
+    const erid = 'every-'+Date.now();
+    const e1 = await c(), e2 = await c();        // e1 = creator/host, e2 = guest
+    await j(e1, erid, 'ehost'); await j(e2, erid, 'eguest'); e1._m.length = e2._m.length = 0;
+    s(e2,'play',{currentTime:1});                 await w(e1,'play');
+    s(e2,'pause',{currentTime:2});                await w(e1,'pause');
+    s(e2,'seek',{currentTime:3});                 await w(e1,'seek');
+    s(e2,'force_sync_prepare',{targetTime:0});    await w(e1,'force_sync_prepare');
+    s(e2,'episode_lobby',{expectedTitle:'S1E1'}); await w(e1,'episode_lobby');
+    // (reaching here without a wait timeout == nothing was gated)
+    close();
+    resetConnectionRate();
+
     // --- Host Control Mode ---
     const hrid = 'host-'+Date.now();
     const h1 = await c(), h2 = await c();          // h1 = host (first joiner), h2 = guest