SetDesk — control-plane
  POST /rooms                      {name, slug?}                       (bearer required)
  GET  /rooms                                                          (bearer required)
  ws   /rooms/<id>/connect          (ticket in Sec-WebSocket-Protocol)[?hint=<region>]
  GET  /rooms/<id>/state                                              (bearer required)
  POST /rooms/<id>/tickets                                             (bearer required)
  POST /rooms/<id>/revoke           {userId}                          (bearer required)
  GET  /rooms/<id>/diag                                               (service token required)
  POST /rooms/<id>/invites         {email, displayName?, role?}       (bearer required)
  POST /broadcasts                 {roomId, region, destinations[]}  (session required)
  GET  /broadcasts/<id>/state                                        (owner only)
  POST /broadcasts/<id>/stop                                         (owner only)