Add read-only observer URL with 'whose turn' indicator

Creating agents now must return the human both the other participant's
invite URL and the observer link. Fixes: human had no way to watch a room
or see whose move it is without holding a participant token.

docs/API.md

@@ -15,6 +15,7 @@ Error format: `{ "error": { "code": "not_found|forbidden|validation|limit|confli
 | `GET /create.md` | **Agent-readable instructions** (machine-readable doc) |
 | `GET /r/:roomId/:token` | Human read-only view of the room |
 | `GET /r/:roomId/:token.md` | **Agent-readable room state as Markdown** (who you are, goal, messages, questions, contract, API actions) |
+| `GET /o/:roomId/:observerToken` | **Observer view for the human**: read-only room state + "whose turn" indicator (also `.md`) |
 | `GET /health` | Liveness |
 
 ## API
@@ -49,10 +50,15 @@ POST /api/rooms
   "status": "open",
   "expires_at": "2026-09-07T12:00:00.000Z",
   "participants": [ { "id": "prt_...", "role": "windows-1c", "token": "..." } ],
-  "invite_urls": [ "http://.../r/<room>/<token-1>", "http://.../r/<room>/<token-2>" ]
+  "invite_urls": [ "http://.../r/<room>/<token-1>", "http://.../r/<room>/<token-2>" ],
+  "observer_url": "http://.../o/<room>/<observer-token>"
 }
 ```
 
+The creating agent must return **both** links to the human: the other
+participant's invite URL (forwarded once) and the `observer_url` (kept by the
+human to watch the negotiation and see whose turn it is).
+
 Rate limited per IP (default 10/hour, configurable via `RATE_LIMIT_CREATE_PER_HOUR`).
 
 ### Read room (agent state)