feat: WebSocket real-time + rAF render gate + guest board + screen picker

Classroom performance:
- WebSocket server (ws-server.js) for low-latency cursor & stroke preview
  Replaces HTTP POST per event → eliminates per-message auth overhead
  Session member cache (30s TTL) avoids SQLite query per WS message
  Fallback to HTTP POST when WS not connected
- Cursor throttle reduced 100ms → 33ms (~30fps)
- Stroke preview throttle reduced 50ms → 20ms
- whiteboard.js: render() is now rAF-gated (_doRender/_rafPending)
  Multiple render() calls within one frame collapse into one repaint
  document.hidden check — zero CPU when tab is in background
  visibilitychange listener restores canvas on tab focus

Guest board:
- guestClassroom.js route: public token-based read-only access
- guest-board.html: name entry + read-only whiteboard + SSE
- SSE: addGuestClient/removeGuestClient/emitToGuests

Screen share picker:
- Discord-style modal with tab switching (screen/window/tab)
- Live video preview before confirming share
- useExistingScreenStream() in ClassroomRTC

Fullscreen exit overlay:
- #cr-fs-exit-overlay button inside cr-board-wrap
- Visible only via CSS :fullscreen selector (touchpad users)

File sharing from library:
- Teacher picks file from library, sends as styled card in chat
- crDownloadLibraryFile() fetches with Bearer auth

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/sse.js

@@ -1,5 +1,6 @@
 /* ── SSE registry — shared between controllers ─────────────────────────── */
-const clients = new Map(); // userId -> Set<res>
+const clients      = new Map(); // userId   -> Set<res>
+const guestClients = new Map(); // sessionId -> Set<res>
 const db = require('./db/db');
 
 function addClient(userId, res) {
@@ -34,6 +35,15 @@ setInterval(() => {
     }
     if (conns.size === 0) clients.delete(userId);
   }
+  for (const [sessionId, conns] of guestClients) {
+    for (const res of conns) {
+      try {
+        if (res.writableEnded || res.destroyed) { conns.delete(res); continue; }
+        res.write(': heartbeat\n\n');
+      } catch { conns.delete(res); }
+    }
+    if (conns.size === 0) guestClients.delete(sessionId);
+  }
 }, 30_000).unref();
 
 /* Broadcast to all members of a class */
@@ -42,9 +52,34 @@ function emitToClass(classId, data) {
   for (const { user_id } of members) emit(user_id, data);
 }
 
+/* ── Guest SSE (session-scoped, no userId) ── */
+function addGuestClient(sessionId, res) {
+  if (!guestClients.has(sessionId)) guestClients.set(sessionId, new Set());
+  guestClients.get(sessionId).add(res);
+}
+
+function removeGuestClient(sessionId, res) {
+  const set = guestClients.get(sessionId);
+  if (!set) return;
+  set.delete(res);
+  if (set.size === 0) guestClients.delete(sessionId);
+}
+
+function emitToGuests(sessionId, data) {
+  const set = guestClients.get(sessionId);
+  if (!set?.size) return;
+  const payload = `data: ${JSON.stringify(data)}\n\n`;
+  for (const res of set) {
+    try { res.write(payload); } catch {}
+  }
+}
+
 /* Returns array of user IDs currently connected via SSE */
 function getOnlineUserIds() {
   return [...clients.keys()];
 }
 
-module.exports = { addClient, removeClient, emit, emitToClass, getOnlineUserIds };
+module.exports = {
+  addClient, removeClient, emit, emitToClass, getOnlineUserIds,
+  addGuestClient, removeGuestClient, emitToGuests,
+};