fix: security hardening, admin route enforcement, and bug fixes

[4RH1T3CT0R7]

Summary

• Path traversal prevention in program Create and Update handlers (filepath.Clean + .. rejection)
• Admin route enforcement — tournament Create/Start/Complete/CreateMatch moved behind RequireAdmin() middleware
• Frontend AdminRoute guard — client-side admin check for /admin route
• SQL placeholder fix in BulkInserter for 10+ columns (fmt.Sprintf instead of rune arithmetic)
• File size enforcement in FileStorage using io.LimitReader (defense against spoofed headers)
• Container log OOM prevention — 2MB combined limit on Docker log output
• Pagination caps (max 1000) on game and tournament list endpoints
• Worker pool scale-down safety — in-flight matches use pool context, not worker context
• WebSocket panic recovery — sendPong recovers from send-on-closed-channel
• Cache nil guard in match processor

Test plan

• go vet ./... — clean
• go test -race -p 1 ./internal/... ./pkg/... — 23/23 packages pass, 0 data races
• 11 review agents confirmed no remaining issues