Make project access hold against a tampering teammate #511

Part of #506.

Follow-up to cooperative access control: make access hold against a teammate who tampers with Ace or copies ACE_SECRET.

• The directory, lobbies, hosted channels, and compute service verify a per-person credential, for example tsidp tokens, instead of the team-wide HMAC. They check access themselves.
• Peers' GitHub logins are verified, for example with a GitHub OAuth proof.
• Private projects' metadata stays out of cells that people without access can read. That includes lobby names derived from local paths.

Out of scope for the first pass; tracked so the hole stays visible.