Lobby: chat at the right window edge, DM rolls hidden from players

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HJhXuLD2Z6hv3Wqeq9UL9K

backend/app/main.py

@@ -582,7 +582,8 @@ MAX_DICE = 10
 
 @api.post("/lobbies/{lid}/rolls")
 def roll_dice(lid: str, body: dict = Body(...), user: dict = Depends(current_user)):
-    """Rolls on the server (so nobody can cheat) and posts the result in the chat; with `to` it is a private roll."""
+    """Rolls on the server (so nobody can cheat) and posts the result in the chat; with `to` it is a private roll.
+    Rolls by the DM are only visible to the DM, or to the person picked with `to`."""
     try:
         sides, count = int(body.get("sides")), int(body.get("count", 1))
     except (TypeError, ValueError):
@@ -595,6 +596,8 @@ def roll_dice(lid: str, body: dict = Body(...), user: dict = Depends(current_use
     with db() as con:
         lobby = _lobby_for(con, lid, user)
         to_id = _recipient(con, lobby, user, body.get("to"))
+        if to_id is None and lobby["owner_id"] == user["id"]:
+            to_id = user["id"]  # the DM's rolls are hidden from the players (unless the DM picks someone to show them to)
         cur = con.execute("INSERT INTO lobby_messages (lobby_id, user_id, to_user_id, kind, text, created) VALUES (?,?,?,?,?,?)",
                           (lid, user["id"], to_id, "roll", json.dumps({"sides": sides, "results": results}), time.time()))
         con.execute("""DELETE FROM lobby_messages WHERE lobby_id=? AND id <= COALESCE(