feat: add scoreboard with player names, per-category leaderboards, and themed tables

Add player_name column to games (migration included), with regex-based
validation and anti-abuse sanitization. New /scoreboard page shows recent
games from localStorage, popular categories with play counts, and top-10
per-category leaderboards sorted by completion time. Also includes
two-click reverse word matching, base URL prefix support for reverse-proxy
hosting, BasePageHandler refactoring, themed table CSS for all 5 themes,
and comprehensive test coverage for player names and scoreboard API.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

static/js/game.js

@@ -1,6 +1,8 @@
 (function () {
     "use strict";
 
+    var BASE = document.body.dataset.baseUrl || "/";
+
     let gameState = null;
     let timerInterval = null;
     let selectedCells = [];
@@ -35,7 +37,7 @@
     // Load categories
     async function loadCategories() {
         try {
-            const resp = await fetch("/api/categories");
+            const resp = await fetch(BASE + "api/categories");
             if (!resp.ok) throw new Error("Server error");
             const categories = await resp.json();
             categorySelect.innerHTML = "";
@@ -65,7 +67,7 @@
             const boardSize = parseInt(boardSizeInput.value);
             const wordCount = parseInt(wordCountInput.value);
             const playerName = playerNameInput.value.trim();
-            const resp = await fetch("/api/game/new", {
+            const resp = await fetch(BASE + "api/game/new", {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
                 body: JSON.stringify({
@@ -253,7 +255,7 @@
     // Send guess to server
     async function sendGuess(payload) {
         try {
-            const resp = await fetch("/api/game/" + gameState.id + "/guess", {
+            const resp = await fetch(BASE + "api/game/" + gameState.id + "/guess", {
                 method: "POST",
                 headers: { "Content-Type": "application/json" },
                 body: JSON.stringify(payload),