fix: harden API, add rate limiting, disable debug by default

- Add input validation and error handling across all API endpoints
  (malformed JSON, missing fields, invalid types return proper 4xx)
- Add per-IP rate limiting (10/min new games, 60/min other requests)
- Add session rollback on unhandled exceptions
- Default debug=False, add --debug CLI flag to opt in
- Frontend: add fetch error handling, fix feedback timeout stacking,
  disable buttons during requests, allow clicking found cells for
  overlapping word selection
- Expand seed data to 7 categories with 25-35 words each

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/game.html

@@ -11,18 +11,25 @@
     <div class="card">
         <div class="card-body">
             <div class="row g-3 align-items-end">
-                <div class="col-md-4">
+                <div class="col-md-3">
                     <label for="category-select" class="form-label">Category</label>
                     <select id="category-select" class="form-select"></select>
                 </div>
-                <div class="col-md-4">
+                <div class="col-md-3">
                     <label for="board-size" class="form-label">
                         Board Size: <span id="size-display">10</span>
                     </label>
                     <input type="range" id="board-size" class="form-range"
                            min="8" max="20" value="10">
                 </div>
-                <div class="col-md-4">
+                <div class="col-md-3">
+                    <label for="word-count" class="form-label">
+                        Word Count: <span id="word-count-display">8</span>
+                    </label>
+                    <input type="range" id="word-count" class="form-range"
+                           min="3" max="30" value="8">
+                </div>
+                <div class="col-md-3">
                     <button id="new-game-btn" class="btn btn-accent btn-lg w-100">
                         Start Game
                     </button>
@@ -74,12 +81,6 @@
                                 Submit
                             </button>
                         </div>
-                        <div class="col-auto">
-                            <button id="submit-selection-btn"
-                                    class="btn btn-outline-light d-none">
-                                Submit Selection
-                            </button>
-                        </div>
                         <div class="col-auto">
                             <button id="clear-selection-btn"
                                     class="btn btn-outline-secondary d-none">