fix: harden API, add rate limiting, disable debug by default

- Add input validation and error handling across all API endpoints
  (malformed JSON, missing fields, invalid types return proper 4xx)
- Add per-IP rate limiting (10/min new games, 60/min other requests)
- Add session rollback on unhandled exceptions
- Default debug=False, add --debug CLI flag to opt in
- Frontend: add fetch error handling, fix feedback timeout stacking,
  disable buttons during requests, allow clicking found cells for
  overlapping word selection
- Expand seed data to 7 categories with 25-35 words each

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/conftest.py

@@ -23,6 +23,13 @@ def db_session(db_engine):
     session.close()
 
 
+@pytest.fixture(autouse=True)
+def clear_rate_limits():
+    from handlers.api import _rate_buckets
+
+    _rate_buckets.clear()
+
+
 @pytest.fixture
 def app(db_engine):
     from app import make_app

tests/e2e/test_api.py

@@ -110,3 +110,151 @@ async def test_text_guess_incorrect(http_server_client, seeded_db):
     assert resp.code == 200
     data = json.loads(resp.body)
     assert data["correct"] is False
+
+
+async def test_new_game_invalid_json(http_server_client, seeded_db):
+    resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body="not json",
+        headers={"Content-Type": "application/json"},
+        raise_error=False,
+    )
+    assert resp.code == 400
+    data = json.loads(resp.body)
+    assert "error" in data
+
+
+async def test_new_game_missing_category_id(http_server_client, seeded_db):
+    body = json.dumps({"board_size": 10})
+    resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body=body,
+        headers={"Content-Type": "application/json"},
+        raise_error=False,
+    )
+    assert resp.code == 400
+    data = json.loads(resp.body)
+    assert "error" in data
+
+
+async def test_new_game_string_board_size(http_server_client, seeded_db):
+    body = json.dumps({"category_id": seeded_db.id, "board_size": "big"})
+    resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body=body,
+        headers={"Content-Type": "application/json"},
+        raise_error=False,
+    )
+    assert resp.code == 400
+    data = json.loads(resp.body)
+    assert "error" in data
+
+
+async def test_new_game_custom_word_count(http_server_client, seeded_db):
+    body = json.dumps({"category_id": seeded_db.id, "board_size": 10, "word_count": 4})
+    resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body=body,
+        headers={"Content-Type": "application/json"},
+    )
+    assert resp.code == 200
+    data = json.loads(resp.body)
+    assert len(data["words"]) <= 4
+
+
+async def test_new_game_string_word_count(http_server_client, seeded_db):
+    body = json.dumps({"category_id": seeded_db.id, "word_count": "many"})
+    resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body=body,
+        headers={"Content-Type": "application/json"},
+        raise_error=False,
+    )
+    assert resp.code == 400
+    data = json.loads(resp.body)
+    assert "error" in data
+
+
+async def test_new_game_nonexistent_category(http_server_client, seeded_db):
+    body = json.dumps({"category_id": 99999})
+    resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body=body,
+        headers={"Content-Type": "application/json"},
+        raise_error=False,
+    )
+    assert resp.code == 404
+    data = json.loads(resp.body)
+    assert "error" in data
+
+
+async def test_guess_invalid_json(http_server_client, seeded_db):
+    body = json.dumps({"category_id": seeded_db.id})
+    create_resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body=body,
+        headers={"Content-Type": "application/json"},
+    )
+    game_id = json.loads(create_resp.body)["id"]
+
+    resp = await http_server_client.fetch(
+        f"/api/game/{game_id}/guess",
+        method="POST",
+        body="not json",
+        headers={"Content-Type": "application/json"},
+        raise_error=False,
+    )
+    assert resp.code == 400
+    data = json.loads(resp.body)
+    assert "error" in data
+
+
+async def test_guess_non_string_word(http_server_client, seeded_db):
+    body = json.dumps({"category_id": seeded_db.id})
+    create_resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body=body,
+        headers={"Content-Type": "application/json"},
+    )
+    game_id = json.loads(create_resp.body)["id"]
+
+    guess_body = json.dumps({"word": 12345})
+    resp = await http_server_client.fetch(
+        f"/api/game/{game_id}/guess",
+        method="POST",
+        body=guess_body,
+        headers={"Content-Type": "application/json"},
+    )
+    assert resp.code == 200
+    data = json.loads(resp.body)
+    assert data["correct"] is False
+
+
+async def test_guess_cells_with_null_element(http_server_client, seeded_db):
+    body = json.dumps({"category_id": seeded_db.id})
+    create_resp = await http_server_client.fetch(
+        "/api/game/new",
+        method="POST",
+        body=body,
+        headers={"Content-Type": "application/json"},
+    )
+    game_id = json.loads(create_resp.body)["id"]
+
+    guess_body = json.dumps({"cells": [None, {"row": 0, "col": 0}]})
+    resp = await http_server_client.fetch(
+        f"/api/game/{game_id}/guess",
+        method="POST",
+        body=guess_body,
+        headers={"Content-Type": "application/json"},
+    )
+    assert resp.code == 200
+    data = json.loads(resp.body)
+    assert data["correct"] is False