Simplify: PHP page dedup, secure UUID, input validation, remove redundant headers

- pages/*.php: 11 files reduced to 1-liners via shared renderPage() helper
- Session: UUID generation uses random_bytes() instead of mt_rand()
- Session: logout cookie uses same security options as create
- API saves: size limits on key (100) and data (500KB)
- API sessions: displayName capped at 64 chars
- API: removed redundant Content-Type headers (Response::json handles it)
- API dashboard: replaced SELECT * with explicit columns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

App/pages/game-3d.php

@@ -1,18 +1 @@
-<?php
-/**
- * GeoGraSim — Klimawächter (3D)
- */
-
-$html = file_get_contents(APP_ROOT . '/game-3d.html');
-
-$sessionScript = '<script>' . "\n"
-    . 'window.__GGS__ = ' . json_encode([
-        'sessionId' => Session::studentId(),
-        'teacherId' => Session::teacherId(),
-        'baseUrl'   => BASE_URL,
-        'basePath'  => BASE_PATH,
-    ], JSON_UNESCAPED_UNICODE) . ";\n"
-    . '</script>';
-
-$html = str_replace('</body>', $sessionScript . "\n</body>", $html);
-echo $html;
+<?php renderPage('game-3d.html');