Simplify: PHP page dedup, secure UUID, input validation, remove redundant headers

- pages/*.php: 11 files reduced to 1-liners via shared renderPage() helper
- Session: UUID generation uses random_bytes() instead of mt_rand()
- Session: logout cookie uses same security options as create
- API saves: size limits on key (100) and data (500KB)
- API sessions: displayName capped at 64 chars
- API: removed redundant Content-Type headers (Response::json handles it)
- API dashboard: replaced SELECT * with explicit columns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

App/php/templates/_scripts.php

@@ -41,3 +41,15 @@ function injectSessionContext(): void {
     ];
     echo '<script>window.__GGS__ = ' . json_encode($ctx, JSON_UNESCAPED_UNICODE) . ';</script>' . "\n";
 }
+
+/** Seite rendern: HTML laden, Session-Kontext injizieren, ausgeben */
+function renderPage(string $htmlFile): void {
+    $html = file_get_contents(APP_ROOT . '/' . $htmlFile);
+    $ctx = '<script>window.__GGS__ = ' . json_encode([
+        'sessionId' => Session::studentId(),
+        'teacherId' => Session::teacherId(),
+        'baseUrl'   => BASE_URL,
+        'basePath'  => BASE_PATH,
+    ], JSON_UNESCAPED_UNICODE) . ';</script>';
+    echo str_replace('</body>', $ctx . "\n</body>", $html);
+}