refactor(wsapi): dedupe routing and seating, fix ordering races

Route room inputs through one toRoom helper, iterate live seats with
connected(), and share seating and reconnect-window code. Declare every
error code once in errcodes.go, which the web vocabulary test now reads.

Fixes:
- a kicked player is released before being told, so their next action
  is answered not_in_a_room
- a rejected word is counted before move_rejected is sent
- room code draw and registration share one lock hold
- two concurrent resumes with one token can no longer both take a seat
- multiplayer tests ready guests one at a time instead of racing

Behaviour changes:
- opening or joining another room while a game is running is refused
  with already_in_a_game
- resigning in the lobby answers game_not_started

server/internal/wsapi/codec.go

@@ -78,9 +78,9 @@ func wordReportedMsg(word string) *noituv1.ServerMessage {
 // errorMsg carries a UI key, never prose and never an internal error string.
 // The Vietnamese copy lives in the frontend so all wording stays in one place,
 // and a raw error would leak server internals to anyone with a socket.
-func errorMsg(code string) *noituv1.ServerMessage {
+func errorMsg(code errCode) *noituv1.ServerMessage {
 	return &noituv1.ServerMessage{Payload: &noituv1.ServerMessage_Error{
-		Error: &noituv1.ServerError{Code: code, Message: code},
+		Error: &noituv1.ServerError{Code: string(code), Message: string(code)},
 	}}
 }