fix: address code review findings

- Add max_length=100 on BulkStatusRequest.room_names to prevent abuse
- Filter bulk endpoint results to rooms user can see (owned or shared)
- Throw on bulk-status fetch error instead of silently returning empty data
- Fix room_by_id type annotation: dict[str, DbRoom] instead of Any
- Remove stale "200ms" comment in test
- Enable strict: true in jest tsconfig
- Remove working docs from tracked files
- Simplify redundant ternary in test helper

www/app/lib/__tests__/meetingStatusBatcher.test.tsx

@@ -67,19 +67,13 @@ function mockBulkStatusEndpoint(
   mockClient.POST.mockImplementation(
     async (_path: string, options: { body: { room_names: string[] } }) => {
       const roomNames: string[] = options.body.room_names;
-      const data = roomData
-        ? Object.fromEntries(
-            roomNames.map((name) => [
-              name,
-              roomData[name] ?? { active_meetings: [], upcoming_events: [] },
-            ]),
-          )
-        : Object.fromEntries(
-            roomNames.map((name) => [
-              name,
-              { active_meetings: [], upcoming_events: [] },
-            ]),
-          );
+      const src = roomData ?? {};
+      const data = Object.fromEntries(
+        roomNames.map((name) => [
+          name,
+          src[name] ?? { active_meetings: [], upcoming_events: [] },
+        ]),
+      );
       return { data, error: undefined, response: {} };
     },
   );
@@ -152,7 +146,6 @@ describe("meeting status batcher integration", () => {
     );
 
     // Without batching this would be 20 calls (2 hooks x 10 rooms).
-    // With the 200ms test window, all queries land in one batch → exactly 1 POST.
     expect(postCalls).toHaveLength(1);
 
     // The single call should contain all 10 rooms (deduplicated)

www/app/lib/meetingStatusBatcher.ts

@@ -14,13 +14,19 @@ export function createMeetingStatusBatcher(windowMs: number = BATCH_WINDOW_MS) {
   return create({
     fetcher: async (roomNames: string[]): Promise<MeetingStatusResult[]> => {
       const unique = [...new Set(roomNames)];
-      const { data } = await client.POST("/v1/rooms/meetings/bulk-status", {
-        body: { room_names: unique },
-      });
+      const { data, error } = await client.POST(
+        "/v1/rooms/meetings/bulk-status",
+        { body: { room_names: unique } },
+      );
+      if (error || !data) {
+        throw new Error(
+          `bulk-status fetch failed: ${JSON.stringify(error ?? "no data")}`,
+        );
+      }
       return roomNames.map((name) => ({
         roomName: name,
-        active_meetings: data?.[name]?.active_meetings ?? [],
-        upcoming_events: data?.[name]?.upcoming_events ?? [],
+        active_meetings: data[name]?.active_meetings ?? [],
+        upcoming_events: data[name]?.upcoming_events ?? [],
       }));
     },
     resolver: keyResolver("roomName"),