fix: harden API, add rate limiting, disable debug by default

- Add input validation and error handling across all API endpoints
  (malformed JSON, missing fields, invalid types return proper 4xx)
- Add per-IP rate limiting (10/min new games, 60/min other requests)
- Add session rollback on unhandled exceptions
- Default debug=False, add --debug CLI flag to opt in
- Frontend: add fetch error handling, fix feedback timeout stacking,
  disable buttons during requests, allow clicking found cells for
  overlapping word selection
- Expand seed data to 7 categories with 25-35 words each

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/main.html

@@ -1,14 +1,17 @@
 {% extends "base.html" %}
 
+{% block active_page %}{% set active_page = "home" %}{% end %}
+
 {% block title %}Word Search — Home{% end %}
 
 {% block content %}
-<div class="text-center py-5">
+<header class="hero">
+    <div class="hero-emoji">🧩</div>
     <h1 class="display-4 fw-bold mb-3">Word Search</h1>
     <p class="lead mb-4">
         Find hidden words in a grid of letters. Words can appear horizontally,
         vertically, or diagonally. How fast can you find them all?
     </p>
-    <a href="/game" class="btn btn-accent btn-lg px-5">Start Game</a>
-</div>
+    <a href="/game" class="btn btn-accent btn-lg px-5">🎮 Start Game</a>
+</header>
 {% end %}