fix: a room that was set up, a card where its button is, and larger cards

Parent Call told rooms they had never been set up. Nothing about the
rooms was wrong. Read from the church broker: …/coordinator and
…/pending are retained and …/mode is absent, and the coordinator's own
source says why — it publishes the retained mode only in answer to an
operator writing to …/mode/set, and nobody ever has. Every classroom
waited a second and a half for a message that will never exist.

A missing mode is now read as the coordinator's own default rather than
as an unconfigured room: the room offers the call and lets the sanctuary
end answer, because that is the end that knows. A mode that really is
off still refuses, in the coordinator's words, and a broker that is
missing or unreachable still says which of those it is. Proved against a
rig broker made to match the church's exactly, with a call landing on
the sanctuary mock.

The card is anchored to the bottom-left corner instead of centred, by
layer shell, which is what the disc player's cover has used under KWin
for months. Anchoring rather than positioning is what makes it right at
1080p and at 4K without a coordinate anywhere. It falls back to the
centred card if the library is missing.

Notifications are sized for a room. Every Plasma measurement is a grid
unit and a grid unit is the height of the general font, so the font is
the lever — 15 point instead of Breeze's 10, which takes the card from
about 350x110 to about 410x145 at 100% and doubles again at 200%. Text,
icon, padding and buttons move together. The chime stays off. No shell
package: that path cost the panel and is not coming back.

And the product name is gone from everything a teacher sees. The
notification card is from Classroom, the disc player's from DVD.

Co-Authored-By: Claude Opus 5 <[email protected]>

tools/lab/lab

@@ -135,6 +135,22 @@ reboot)
     done
     docker exec "$NAME" ln -sf /usr/bin/qdbus6 /usr/local/bin/qdbus
 
+    # The fence again. Routes do not survive a container restart, and the
+    # lab reached the church broker through exactly that gap: four rooms
+    # named after container ids on the real broker, from sessions that
+    # had been fenced when they started and were not after a reboot.
+    docker exec "$NAME" sh -c '
+        for net in 10.30.0.0/16 10.40.0.0/16; do
+            ip route replace blackhole "$net" || exit 1
+        done' || echo "  WARNING: could not fence the church networks"
+
+    for target in 10.40.0.2/1883 10.30.0.2/1025; do
+        if docker exec "$NAME" timeout 4 bash -c "exec 3<>/dev/tcp/${target}" 2>/dev/null; then
+            echo "REFUSING TO CONTINUE: ${target} is reachable from the lab" >&2
+            exit 1
+        fi
+    done
+
     # SDDM really does autologin here: it authenticates the classroom
     # through PAM and launches the Plasma session, and then has no display
     # hardware to draw it on. That is worth having — it is the real login