Clean up Among Them roster checks

[relh]

Summary

• Removes the duplicated pre-upgrade roster auth and duplicate-player checks added around Tighten Among Them token roster joins #170.
• Keeps the runtime contract simple: /player records the requested identity, slot, and token; sim.addPlayer owns slot/token/occupancy/closed-roster validation.
• Keeps token-to-configured-name derivation for hosted joins and a clearer closed-roster-full error from the sim.

Why

Andre's concern on #170 was right: the server should not carry a second copy of the roster contract. If a player join is explicit via slot/token, the server now upgrades the websocket and lets the sim join path either accept it or close it. Anonymous extra viewers can still fall back to the existing spectator path.

Verification

• nim c among_them/among_them.nim
• Branch-local closed-roster E2E server: valid slot=0&token=crew-token and slot=1&token=imp-token stayed connected.
• Same server closed duplicate slot 0, bad token, and outside-roster explicit joins through the sim join path.
• Full local Coworld episode using branch-built bitworld-among-them-runner:pr175-e2e-5ca8b0b passed with coworld run-episode /tmp/bitworld-pr175-coworld_manifest.json --output-dir /tmp/bitworld-pr175-e2e --timeout-seconds 600 --verify-replay after the runner compatibility fix in Metta PR https://github.com/Metta-AI/metta/pull/13399.
• git diff --check