Fix blank guest room authorization

[axhoff]

Summary

• prevent empty configured guest or admin passwords from authenticating a blank login
• preserve existing non-empty admin, non-empty guest, open read-only, and closed-server behavior
• extract the authorization decision into a small pure helper and cover the permission matrix with native tests

Root cause

The room server compared the supplied password with configured role passwords before applying allow.read.only. When both strings were empty, strcmp() succeeded and promoted an anonymous user instead of treating the empty configured password as a disabled authenticated role.

Empty admin and guest passwords now disable their corresponding authenticated roles. With allow.read.only enabled, a blank or incorrect password receives the existing guest permission; with it disabled, the login is rejected.

Compatibility

• matching non-empty admin passwords still grant admin access
• matching non-empty guest passwords still grant read/write access
• existing ACL clients retain their stored permissions
• no protocol, storage, packet, or radio behavior changes

Validation

• pio test -e native: 21/21 tests passed
• pio run -e Heltec_v3_room_server: passed (ESP32)
• pio run -e RAK_4631_room_server: passed (nRF52)
• pio run -e PicoW_room_server: passed (RP2040)
• external Fable adversarial review: blank-admin twin finding corrected; follow-up verdict Go

Fixes #940