Fix path traversal via username in session log file paths

Registration only validated username with NotBlank, so a username
like "../../../../public/x" got concatenated directly into a
filesystem path for both writing (game activity logs) and reading
(admin log viewer) - reachable from the public webroot since public/
is a few directories up from where those logs are stored.

Adds a character-set validator (letters, numbers, underscore, hyphen)
to registration and admin user editing going forward, and sanitizes
at the point of use (Player::getLogFileBasename()) so any
already-stored unsafe username can't escape the log directory either.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/Game/Service/GameResponseService.php

@@ -107,14 +107,13 @@ class GameResponseService
     private function logSessionActivity(Player $player, string $content): void
     {
         $sessionId = $player->getSession()->getId();
-        $username = $player->getUser()->getUsername();
         $logDir = $this->projectDir . '/var/log/sessions/' . $sessionId;
 
         if (!is_dir($logDir)) {
             mkdir($logDir, 0777, true);
         }
 
-        $logFile = $logDir . '/' . $username . '.txt';
+        $logFile = $logDir . '/' . $player->getLogFileBasename() . '.txt';
         $timestamp = date('Y-m-d H:i:s');
         $logMessage = sprintf("[%s] %s\n", $timestamp, $content);