- POST /api/v1/lobbies creates a lobby with a Crockford-Base32
6-char code, retrying on unique violation up to 5 times
- POST /api/v1/lobbies/:code/join validates lobby state then
calls the model's atomic addPlayer, idempotent for repeat
joins from the same user
- Routes require authentication via requireAuth
