Allow toggling room privacy after creation (#48)

is_private was previously only settable at room creation. RoomUpdate now
accepts it, update_room() applies it, and PATCH /api/rooms/{id} allows a
site admin to make the change even for a room they haven't joined (in
addition to the existing room owner/admin gate) -- require_room_role
normally 403s a non-member before the role check ever runs, so this is a
deliberate bypass for site admins specifically.

Flipping the flag has no effect on existing members either direction
(confirmed is_private is only ever checked at self-serve join time) --
it purely controls Browse Rooms visibility and future self-joins.

Frontend: RoomInfoPanel's "Room settings" section is now visible to room
owner, room admin, or site admin (was owner-only), with a privacy toggle
reusing NewRoomModal's existing toggle-switch UI. "Delete room" stays
owner-only, now nested inside that wider section rather than gating the
whole thing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/routers/rooms.py

@@ -156,7 +156,12 @@ async def update_room_endpoint(
 ):
     try:
         room = await get_room(db, room_id)
-        await require_room_role(room_id, current_user, db, RoomRole.admin)
+        # Room owner/admin (the pre-existing gate for name/description) or a
+        # site admin regardless of membership -- #48 explicitly wants site
+        # admins able to toggle is_private even for rooms they haven't
+        # joined, unlike require_room_role's normal membership requirement.
+        if not current_user.is_site_admin:
+            await require_room_role(room_id, current_user, db, RoomRole.admin)
         return await update_room(db, room, data)
     except RoomNotFoundError:
         raise HTTPException(status_code=404, detail="Room not found")

backend/app/schemas/room.py

@@ -16,6 +16,7 @@ class RoomCreate(BaseModel):
 class RoomUpdate(BaseModel):
     name: str | None = Field(default=None, min_length=1, max_length=100)
     description: str | None = Field(default=None, max_length=2000)
+    is_private: bool | None = None
 
 
 class RoomRead(BaseModel):

backend/app/services/room_service.py

@@ -190,6 +190,8 @@ async def update_room(db: AsyncSession, room: Room, data: RoomUpdate) -> Room:
         room.name = data.name
     if data.description is not None:
         room.description = data.description
+    if data.is_private is not None:
+        room.is_private = data.is_private
     try:
         await db.commit()
     except IntegrityError as exc: