Adds bounded per-room Viewer password entry while preserving grant/public paths and Native v2 wire compatibility.