Persist solves by hiding expired rooms

[coder13]

Summary

• Stop using MongoDB TTL deletion for normal room expiry.
• Add hiddenAt to rooms and use it as the lobby visibility cutoff while keeping room documents, scrambles, attempts, and embedded solve results intact.
• Filter hidden rooms out of lobby room lists and reject joins once a room is hidden.
• Emit the existing ROOM_DELETED socket event when a room reaches hiddenAt, so connected clients remove it from the lobby without deleting it from MongoDB.
• Change admin room deletion to hide the room document instead of removing it.
• Fix existing lint-only formatting in server/middlewares/auth.js so server lint passes.

Notes

The old expireAt field is now cleared whenever room stale state changes, so an existing production TTL index on expireAt will no longer remove rooms touched by the app. New hide timing is stored in hiddenAt instead.

Validation

• cd server && npm run lint