feat: Enforce exclusive auto-request (one client at a time)

Server is now source of truth for autoRequest. When a client enables it,
all other clients lose it. Broadcast includes autoRequest per client,
frontend syncs from server state on each torch-update.

frontend/src/components/TorchButton.vue

@@ -2,7 +2,7 @@
 import { ref, computed, onMounted, onUnmounted, nextTick } from 'vue'
 import { useTorchStore } from '../stores/torch'
 import { useCanvasStore } from '../stores/canvas'
-import { requestTorch, releaseTorch, transferTorch, updateName } from '../services/torch'
+import { requestTorch, releaseTorch, transferTorch, updateName, setAutoRequest } from '../services/torch'
 
 const torchStore = useTorchStore()
 const canvasStore = useCanvasStore()
@@ -86,7 +86,7 @@ async function handleTransfer(targetId: string) {
 }
 
 function toggleAutoRequest() {
-  torchStore.setAutoRequest(!torchStore.autoRequest)
+  setAutoRequest(!torchStore.autoRequest)
 }
 
 onMounted(() => {