SetDesk — control-plane
  POST /rooms                      {name, slug?}                       (bearer required)
  GET  /rooms                                                          (bearer required)
  ws   /rooms/<id>/connect          (ticket in Sec-WebSocket-Protocol)[?hint=<region>]
  GET  /rooms/<id>/state                                              (bearer required)
  POST /rooms/<id>/tickets                                             (bearer required)
  POST /rooms/<id>/revoke           {userId}                          (bearer required)
  POST /auth/sign-up/email | /auth/sign-in/email    {email, password}
       sign-up is invite-only where SIGNUP_ALLOWED_EMAILS is set (403)
  GET  /me                                          (session required)
  POST /broadcasts                 {roomId, region, destinations[]}  (session required)
  GET  /broadcasts/<id>/state                                        (owner only)
  POST /broadcasts/<id>/stop                                         (owner only)