fix: harden API, add rate limiting, disable debug by default

- Add input validation and error handling across all API endpoints
  (malformed JSON, missing fields, invalid types return proper 4xx)
- Add per-IP rate limiting (10/min new games, 60/min other requests)
- Add session rollback on unhandled exceptions
- Default debug=False, add --debug CLI flag to opt in
- Frontend: add fetch error handling, fix feedback timeout stacking,
  disable buttons during requests, allow clicking found cells for
  overlapping word selection
- Expand seed data to 7 categories with 25-35 words each

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/conftest.py

@@ -23,6 +23,13 @@ def db_session(db_engine):
     session.close()
 
 
+@pytest.fixture(autouse=True)
+def clear_rate_limits():
+    from handlers.api import _rate_buckets
+
+    _rate_buckets.clear()
+
+
 @pytest.fixture
 def app(db_engine):
     from app import make_app