ResumeToken

Opaque token a joiner presents when reconnecting after a transport drop.

The leader validates two claims:

1. The roomId matches the current session — prevents cross-session replay.

2. The reconnect window for peerId is still open — prevents stale reconnects.

The leader's own identity is not encoded here. Only roomId is. This preserves forward-compatibility: if an auto-election protocol replaces the leader mid-session, roomId survives the transition and joiners can resume against the new host without token renegotiation.

issuedAt is epoch-millis from the injected clock (never System.currentTimeMillis directly — callers must inject via clock: () -> Long).