[studio] beta studio (#114)

* rrs stuff

* studio service yay

* rrs whitelist

* moree studiooooooo fellowwww

* rec room studio room loading yay

* fixes yay

* fix 2 because idk  yayuh

* Update cdn.app.ts

* ccontent length fix?

* Preserve content-length and upgrade metadata

Return a real zero-filled byte array for CDN HEAD responses so the runtime preserves Content-Length while still sending no payload. In notify, re-create the Request with its original headers, set OWNER_HEADER from the validated token, and forward that Request to hub.fetch to avoid losing WebSocket upgrade metadata (which could trigger 500s in Durable Objects). These changes ensure the editor's size checks and WebSocket upgrades remain reliable.

* fix x524234

* shirt thing?

* [auth] remove grant table as we already have audit_log for now

* rename table to generic device_grant

* cleanup/lint

---------

Co-authored-by: Devin Zuczek <devin.zuczek@gmail.com>

CLI.md

@@ -51,6 +51,18 @@ bun runx admin grant-developer --account 1 --revoke
 bun runx admin grant-moderator --username alice --remote
 ```
 
+### `grant-studio` — grant or revoke Rec Room Studio upload access
+
+Sets the account's `hasStudio` flag, which `auth` stamps into the token as the
+`betastudio` role — the claim RecFlare Studio reads as permission to upload. Staff
+normally manage this from the website (`/settings/recroomstudio`); this is the
+operator's way in. Takes effect on the player's next Studio sign-in or refresh.
+
+```sh
+bun runx admin grant-studio --username alice
+bun runx admin grant-studio --account 42 --revoke
+```
+
 ### `reload-plus` — credit every Plus subscriber's tokens
 
 Also exposed directly as `just reload-plus`.