Fix P1/P2 security findings from adversarial review

[hashd]

Summary

Addresses 23 findings (P1 critical + P2 significant) from the adversarial security review.

P1 Critical fixes

• Cross-ticket prize claim fraud — struck set now filtered per-ticket during claims and progress computation
• join_secret leaked in state API — stripped from sanitize_state
• Full game state returned to any user — REST show endpoint now filters to requesting user's tickets/struck/progress
• Ticket broadcast to all subscribers — player_tickets_updated only sent to the owning player

P2 Significant fixes

• Magic link auto-registers unknown emails — now returns error, controller hides email existence
• Magic link replay race — atomic delete replaces update-used_at
• Prize progress leaks opponent data — filtered per-ticket
• Game code space (~25K) — expanded to ~250K with 3-digit numbers
• No player/game limits — max 100 players/game, max 5 active games/user
• list_public_games O(n) GenServer calls — reads Registry metadata instead
• Chat text unsanitized/unbounded — 500 char limit + validation
• Reaction emoji unvalidated — allowlist enforced
• create_game race condition — wrapped in DB transaction
• Rate limit TOCTOU — atomic ETS increment
• Monitor calls :state every minute — uses Registry metadata
• CORSPlug with no config — explicit origins configured
• Logout doesn't revoke token — bearer token deleted on logout
• inspect(reason) in error response — replaced with generic message
• No validation on game create params — name length, visibility, join_secret validated

Test plan

• mix test — 127 tests pass (2 properties + 125 tests, 0 failures)
• Updated code format tests for WORD-NNN format
• Updated magic link tests for new return type
• Manual test: verify game creation, join, and prize claiming flows
• Manual test: verify magic link and OTP login still work