Add CSRF protection, login throttling, and invite-code rate limiting

The admin panel already checked CSRF tokens on destructive actions,
but the player-facing raw HTML forms (create/join/leave/start
session, toggle ready, lobby chat, feedback) had none - cookie
SameSite=Lax blunts classic cross-site auto-submit attacks but isn't
a substitute for real tokens. Adds matching csrf_token()/
isCsrfTokenValid() checks to all of them.

Also adds login_throttling (5 attempts/15 min) to stop unlimited
password guessing, and a per-user rate limiter (10/min) on the
invite-code join endpoint, since invite codes are only 32-bit and
had no protection against brute-forcing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

templates/game/lobby.html.twig

@@ -29,6 +29,7 @@
 
                     {% if session.players|length >= session.game.numberOfPlayers %}
                         <form method="post" action="{{ path('game_dashboard') }}" class="mb-3">
+                            <input type="hidden" name="_token" value="{{ csrf_token('start_session_' ~ session.id) }}">
                             <input type="hidden" name="session_id" value="{{ session.id }}">
                             <button type="submit" name="start_session" class="btn btn-success">Start Session</button>
                         </form>
@@ -71,6 +72,7 @@
 
                 {% if player %}
                     <form method="post" class="d-flex gap-2">
+                        <input type="hidden" name="_token" value="{{ csrf_token('send_message_' ~ session.id) }}">
                         <input type="text" name="content" class="form-control" placeholder="Type a message&hellip;" maxlength="500" required autocomplete="off">
                         <button type="submit" name="send_message" class="btn btn-primary">Send</button>
                     </form>