news: the adventure page gets something that's actually happening

Every dispatch Pete publishes is an accomplishment — a death, a clear, a
milestone — and an accomplishment is a newspaper clipping the moment it lands.
No refresh interval fixes that. So the page never felt alive, and it never was
going to.

The board is the other kind of thing: state that is currently true. gogobee
pushes the whole roster, we replace ours with it, and it renders above the
clippings. An open tab re-polls so it keeps telling the truth.

Replace, never merge: anyone gogobee omits (opted out, no character) drops off
the public page. That omission IS the opt-out — a standing row showing class,
level and zone names the player anyway, so "an adventurer" would have been a fig
leaf.

The snapshot time lives in its own row, because an empty board is ambiguous:
nobody playing, or gogobee stopped talking to us. The page has to tell those
apart — one is a quiet realm, the other is a board that lies confidently, which
is worse than one that admits it lost the wire.

Also teaches Pete "departure", so a bored adventurer letting itself out is news.

internal/web/server.go

@@ -188,6 +188,11 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
 	// outside the sign-in block. Self-gates on adv.Enabled (404 when off).
 	mux.HandleFunc("POST /api/ingest/adventure", s.handleAdventureIngest)
 
+	// The live board. Ingest is bearer-authed like the fact seam; the read side
+	// is public because it renders on a public page anyway.
+	mux.HandleFunc("POST /api/ingest/roster", s.handleRosterIngest)
+	mux.HandleFunc("GET /api/roster", s.handleRosterAPI)
+
 	// Per-dispatch permalink (the article_url every ingested story points at).
 	// Public GET; self-gates on adv.Enabled. Distinct from GET /adventure (the
 	// channel listing, registered in the channels loop above).