Add the Stoa: walkable spaces with live presence, rooms, and calls

[guohai]

Why

Agora.build is becoming a walkable world built around resource discovery. This PR brings in the Stoa: the plaza, its first-come rooms, and people's own spaces, with live presence, chat and calls on Agora. It covers Plans A, B, C1 and C2 of the spec and replaces PR #1, which held only Plan A.

• Spec: docs/superpowers/specs/2026-10-07-stoa-spaces-design.md
• Plans: docs/superpowers/plans/2026-10-07-spaces-core.md (A), 2026-10-07-world-engine.md (B), 2026-10-08-stoa-live.md (C1), 2026-10-08-stoa-rooms.md (C2)

What changes

• Spaces core (A):
  • Listed, unlisted and private spaces with separate access rules, one can() check, entry leases, and hosts.
  • Lot rooms from the map. User spaces with invites and members.
  • Agora RTC and Signaling tokens. Secret-derived channel names and per-space keys that rotate on removal.
  • Private spaces return 404 to people who can't see them.
• World engine and themes (B):
  • Tiled maps with semantic roles, and A* pathfinding shared by browser and server.
  • A canvas renderer.
  • Data-only themes (Agora, Minimal, Cyberpunk) validated at startup.
  • Click, tap and keyboard movement, and reduced-motion support.
• Live Stoa (C1):
  • Presence, movement and room chat over Agora Signaling, with encrypted payloads in unlisted and private spaces.
  • Rate limits and receiver checks.
  • A plaza capped at 200, ready for area-of-interest cells later.
• Rooms (C2):
  • Calls inside rooms. A UI-free RTC client, plus theme video layouts: over avatars, strip, or grid.
  • Decorate mode for hosts, with the server's placement rules checked as you edit.
  • Host hand-over and removal; removal moves the room to a new channel.
  • Creating and managing your own spaces: settings, invite links, members, and delete.
• Meetings retired:
  • /meet/<id> and meetings.html redirect into the Stoa, and /api/rooms returns 410.
  • "Start a room" buttons open the Stoa's create dialog.
  • Sign-in can return to Stoa pages.

Existing meeting rooms are migrated into unlisted, members-only spaces with the same IDs, so old links keep working.

Configuration

.env.example adds SPACE_CHANNEL_SECRET, AGORA_RTM_PERMISSIONS and PLATFORM_ADMINS. The Agora project needs Signaling enabled. Without Agora credentials, the Stoa still loads; live presence and calls show as not connected.

Verification

• npm test: 288 pass, 0 fail, 1 skipped (the PostgreSQL test, which needs a database). npm run build succeeds.
• Every task had a spec and code review, each plan had a final whole-branch review, and the review fixes are in the branch.
• Live checks with real Agora, using two signed-in browsers and a guest:
  • C1: presence in about 1.6 s and chat in about 0.3 s. Lot rooms and topics, a private space with an invite, and no plaintext in captured websocket frames.
  • C2: video over avatars in about 0.2 s and screen share in 0.9 s. Decorations reach others in 0.2 s. Removal takes effect in about 0.3 s, and re-entry is refused. A private space invite and call worked.
  • Results are recorded at the end of the C1 and C2 plans.
• Desktop (1280 px) and mobile (390 px) screenshots were checked locally for the plaza, rooms, calls, decorate mode and the space dialogs. They aren't attached here.

Known gaps and follow-ups

• Tab restore: headless Chromium never restored the page from the back/forward cache, so reload-on-restore is untested. A plain Back works.
• Hosting hand-over: it shows in about 3 s, because room refreshes are limited to one every 5 s.
• Removed callers: a removed person's client could stay on the call until its RTC token expires (at most 1 hour), as the spec allows.
• Next:
  • Plan D: Agora Chat for team messages and DMs.
  • Plan E: discovery hooks.
  • Area-of-interest cells for a bigger plaza.

Generated with SMT smt@agora.build