Any member can destroy a room; observer sees highlighted whose turn it is

- DELETE /api/rooms/:id + destroy button in the header of human pages
  (participant and observer views), with confirmation
- turn indicator now names and highlights the expected participant(s)

packages/core/test/core.test.ts

@@ -145,6 +145,26 @@ test('limits: ttl > 24h rejected, oversize message rejected, 1 participant rejec
   );
 });
 
+test('destroyRoom: allowed for participant and observer, rejected for strangers', () => {
+  const { svc } = makeService();
+  const created = createTwoPartyRoom(svc);
+  const roomId = created.room_id;
+  const tokenA = created.participants[0].token;
+  const observerToken = created.observer_url.split('/').pop()!;
+  // stranger
+  assert.throws(() => svc.destroyRoom(roomId, 'forged-token'), RendezvousError);
+  // observer may read and destroy
+  const view = svc.getObserverView(roomId, observerToken);
+  assert.ok(view.turn.length > 0);
+  svc.destroyRoom(roomId, observerToken);
+  assert.throws(() => svc.getRoomView(roomId, tokenA), RendezvousError, 'room is gone');
+
+  // participant may also destroy
+  const c2 = createTwoPartyRoom(svc);
+  svc.destroyRoom(c2.room_id, c2.participants[1].token);
+  assert.throws(() => svc.getRoomView(c2.room_id, c2.participants[0].token), RendezvousError);
+});
+
 test('only addressee or author can resolve a question', () => {
   const { svc } = makeService();
   const created = createTwoPartyRoom(svc);