Add CSRF protection, login throttling, and invite-code rate limiting

The admin panel already checked CSRF tokens on destructive actions,
but the player-facing raw HTML forms (create/join/leave/start
session, toggle ready, lobby chat, feedback) had none - cookie
SameSite=Lax blunts classic cross-site auto-submit attacks but isn't
a substitute for real tokens. Adds matching csrf_token()/
isCsrfTokenValid() checks to all of them.

Also adds login_throttling (5 attempts/15 min) to stop unlimited
password guessing, and a per-user rate limiter (10/min) on the
invite-code join endpoint, since invite codes are only 32-bit and
had no protection against brute-forcing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

templates/game/waiting.html.twig

@@ -63,6 +63,7 @@
                     </div>
                 {% endif %}
                 <form method="post" class="mt-4">
+                    <input type="hidden" name="_token" value="{{ csrf_token('toggle_ready_' ~ session.id) }}">
                     <input type="hidden" name="toggle_ready" value="0">
                     <div class="form-check form-switch mb-3">
                         <input class="form-check-input" type="checkbox" id="toggle_ready" name="toggle_ready" value="1" onchange="this.form.submit()" {{ isReady ? 'checked' : '' }} {{ not app.user.verified ? 'disabled' : '' }}>
@@ -87,6 +88,7 @@
 </div>
 
 <form id="expire-ready-form" method="post" style="display:none">
+    <input type="hidden" name="_token" value="{{ csrf_token('expire_ready_' ~ session.id) }}">
     <input type="hidden" name="expire_ready" value="1">
 </form>