Add DRF API app and real-time draft management UI

- Created new `api` Django app with serializers, viewsets, and routers
  to expose draft sessions, participants, and movie data.
- Registered `api` app in settings and updated root URL configuration.
- Extended WebSocket consumers with `inform.draft_status` /
  `request.draft_status` to allow fetching current draft state.
- Updated `DraftSession` and related models to support reverse lookups
  for draft picks.
- Enhanced draft state manager to include `draft_order` in summaries.
- Added React WebSocket context provider, connection status component,
  and new admin/participant panels with phase and participant tracking.
- Updated SCSS for participant lists, phase indicators, and status badges.
- Modified Django templates to mount new React roots for admin and
  participant views.
- Updated Webpack dev server config to proxy WebSocket connections.

api/views.py

@@ -0,0 +1,60 @@
+from rest_framework import viewsets, permissions
+from rest_framework.exceptions import NotFound
+from django.contrib.auth import get_user_model
+from boxofficefantasy.models import Movie
+from draft.models import DraftSession, DraftPick
+from django.shortcuts import get_object_or_404
+
+
+from django.db.models import Prefetch
+
+from .serializers import (
+    UserSerializer, MovieSerializer, DraftSessionSerializer
+)
+
+User = get_user_model()
+
+class UserViewSet(viewsets.ReadOnlyModelViewSet):
+    queryset = User.objects.all()
+    serializer_class = UserSerializer
+    permission_classes = [permissions.IsAuthenticated]
+    lookup_field = "username"
+
+
+class MovieViewSet(viewsets.ReadOnlyModelViewSet):
+    queryset = Movie.objects.all().order_by('id')
+    serializer_class = MovieSerializer
+    permission_classes = [permissions.IsAuthenticated]
+
+class DraftSessionViewSet(viewsets.ReadOnlyModelViewSet):
+    """
+    GET /api/drafts/<hashed_id>/
+    Returns participants, movies, settings, and picks for a draft session.
+    Access limited to participants or staff.
+    """
+    serializer_class = DraftSessionSerializer
+    # permission_classes = [permissions.IsAuthenticated, IsParticipantOfDraft]
+    lookup_field = "hashid"         # use hashed id instead of pk
+    lookup_url_kwarg = "hid"    # url kwarg name matches urls.py
+
+    def get_object(self):
+        hashid = self.kwargs[self.lookup_url_kwarg]
+        pk = DraftSession.decode_id(hashid)
+        if pk is None:
+            raise NotFound("Invalid draft id.")
+        obj = get_object_or_404(self.get_queryset(), pk=pk)
+        # Trigger object-level permissions (participant check happens here)
+        self.check_object_permissions(self.request, obj)
+        return obj
+
+    def get_queryset(self):
+        # Optimize queries
+        return (
+            DraftSession.objects
+            .select_related("season", "settings")
+            .prefetch_related(
+                "participants",
+                "movies",
+                Prefetch("draft_picks", queryset=DraftPick.objects.select_related("winner", "movie")),
+            )
+        )