fix(host-control-mode): audit findings — host dedup demotion, episode-lobby freeze, +cleanups

Findings recovered from the multi-agent audit (verification phase was cut off by a
usage limit; verified inline against the code):

HIGH:
- Host was demoted on peerId dedup (fast reconnect / second tab): the dedup path
  removes the old socket and the kicked socket's 'disconnect' both ran the
  host-leave fallback before the same peerId re-joined → room silently unlocked on
  every host network blip. Now skip the fallback while a join for that peerId is in
  flight (peerJoinLocks). Regression test added. (A long real disconnect still
  falls back — that's the deferred host-grace EC-10.)
- Episode auto-advance froze a gated guest: in host-only the guest's EPISODE_LOBBY
  is dropped server-side, but the guest still self-paused (PAUSE_FOR_LOBBY) waiting
  for readies that never came → 60s freeze. A host-only guest now skips creating a
  lobby (the host drives episode sync).

LOW / cleanup:
- GET_HCM_STRINGS could return a raw key name ("HCM_DIALOG_TITLE") if the locale
  dictionary failed to load (getMessage returns the key on miss) → omit it so
  content keeps its English fallback.
- hcmReset now also clears the snap-back cooldown + buffering grace, so a stale
  cooldown can't swallow the first snap-back after a room/host change.
- Popup play/pause labels reset on lock too (not just unlock), so a button can't
  freeze on "Playing…" when host-only activates mid-click.
- Fix a stale comment (heartbeat now carries 'desynced').

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/test-server-ws.mjs

@@ -151,6 +151,25 @@ try {
     assert.ok(dSenderResync && dSenderResync.controlMode==='host-only',
         'debounced toggle re-syncs sender to actual state');
     close();
+    resetConnectionRate();
+
+    // --- Host role survives peerId dedup (reconnect / second tab) ---
+    const hdrid = 'dedup-host-'+Date.now();
+    const hd1 = await c(), hd2 = await c();
+    await j(hd1, hdrid, 'dhost'); await j(hd2, hdrid, 'dguest'); hd1._m.length = hd2._m.length = 0;
+    s(hd1,'set_control_mode',{controlMode:'host-only'});
+    await w(hd1,'control_mode'); await w(hd2,'control_mode');
+    hd1._m.length = hd2._m.length = 0;
+    // The host's peerId re-joins on a fresh socket → server dedupes the old socket.
+    // This must NOT demote the host or reset the mode (a network blip / second tab).
+    const hd3 = await c();
+    s(hd3,'join_room',{roomId:hdrid,peerId:'dhost',protocolVersion:'1.0.0'});
+    const hdrd = await a(hd3);
+    assert.equal(hdrd[0],'room_data');
+    assert.ok(hdrd[1].controlMode === 'host-only' && hdrd[1].hostPeerId === 'dhost',
+        'host role + host-only mode survive peerId dedup (reconnect/second tab)');
+    close();
+    resetConnectionRate();
 
     // --- Password room ---
     const prid = 'pw-'+Date.now();