♻️(all) stop relying on cookies for the lobby flow

The lobby system relied on cookies to identify the participant
across the wait/enter cycle, which does not work in an iframe
context where our cookies are dropped.

Simplify the lobby behavior:

* The POST request that enters the lobby now returns the
  participant id in the response.
* The frontend passes that id back on subsequent requests to keep a
  sticky session while trying to enter the room.

This moves a bit more logic to the frontend but should be a
transparent refactoring, without decreasing the security of the
lobby flow.

src/backend/core/api/serializers.py

@@ -292,6 +292,11 @@ class RequestEntrySerializer(BaseValidationOnlySerializer):
     """Validate request entry data."""
 
     username = serializers.CharField(required=True)
+    participant_id = serializers.UUIDField(required=False, allow_null=True)
+
+    def validate_participant_id(self, value):
+        """The id is a bearer credential: never trusted, only looked up."""
+        return str(value) if value else None
 
 
 class ParticipantEntrySerializer(BaseValidationOnlySerializer):