Add index page with URL generator and remove passphrase from display

Created a beautiful landing page with random room/passphrase generation
and updated security model for read-only access.

New Files:
- server/php/index.html: Landing page with URL generator

Features:
- Random room name generation (e.g., "swift-phoenix-1234")
- Random passphrase generation (16 chars, URL-safe)
- Copy-to-clipboard functionality
- Responsive design with gradient header
- Step-by-step usage instructions
- FAQ section

Security Model Changes:
- WRITE (send transcriptions): Requires room + passphrase
- READ (view display): Only requires room name

Updated Files:
- server.php:
  * handleStream(): Passphrase optional (read-only)
  * handleList(): Passphrase optional (read-only)
  * Added roomExists() helper function

- display.php:
  * Removed passphrase from URL parameters
  * Removed passphrase from SSE connection
  * Removed passphrase from list endpoint

Benefits:
- Display URL is safer (no passphrase in OBS browser source)
- Simpler setup (only room name needed for viewing)
- Better security model (write-protected, read-open)
- Anyone with room name can watch, only authorized can send

Example URLs:
- Client: server.php (with room + passphrase in app settings)
- Display: display.php?room=swift-phoenix-1234&fade=10&timestamps=true

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

server/php/display.php

@@ -71,7 +71,6 @@
         // Get URL parameters
         const urlParams = new URLSearchParams(window.location.search);
         const room = urlParams.get('room') || 'default';
-        const passphrase = urlParams.get('passphrase') || '';
         const fadeAfter = parseInt(urlParams.get('fade') || '10');
         const showTimestamps = urlParams.get('timestamps') !== 'false';
 
@@ -96,7 +95,7 @@
 
         // Connect to Server-Sent Events
         function connect() {
-            const url = `server.php?action=stream&room=${encodeURIComponent(room)}&passphrase=${encodeURIComponent(passphrase)}`;
+            const url = `server.php?action=stream&room=${encodeURIComponent(room)}`;
             const eventSource = new EventSource(url);
 
             eventSource.onopen = () => {
@@ -162,7 +161,7 @@
         // Load recent transcriptions on startup
         async function loadRecent() {
             try {
-                const url = `server.php?action=list&room=${encodeURIComponent(room)}&passphrase=${encodeURIComponent(passphrase)}`;
+                const url = `server.php?action=list&room=${encodeURIComponent(room)}`;
                 const response = await fetch(url);
                 const data = await response.json();