Creating a room requires sign-in, so ownership, sharing, and audit rules work. Sign in at login.html (the single login / sign-up page) if you are not signed in.
Pick a room, then manage who can see it. Secure passwords are never shown or stored in plaintext — only a SHA-256 hash is stored, exactly as in the existing app. Private rooms: owner + listed members only. Public rooms: anyone with the link, no login. Secure rooms: allowed emails + password, before expiry.
Audit rows are insert-only on the server. Only room owners / members can read them (RLS) — public and secure viewers cannot read or rewrite the audit trail. If a room's audit appears empty here, you are not an owner/member of that room.