fix(server): name the player on every played word, and bound the process

PlayedWord.player_id was declared and read by the client but never set by
the server, so a room of three or four never showed who played each word.
The chain byline now comes from the room, with a producer-side test.

The process also gains the ceilings it was missing: a cap on live rooms and
on open sockets, a per-connection frame-rate limit so a payload-less frame
is no longer free, and an opt-in trusted-proxy list so the join limiter can
tell players apart behind the documented reverse proxy instead of putting
them in one bucket. The typed word is sanitized before the engine stores it,
since every seat is shown it; a room exiting on its idle clock releases the
sessions still bound to it; the dictionary builder escapes its SQLite path
like the store does and renames over the old database instead of deleting
it first.

server/internal/wsapi/convert_test.go

@@ -170,12 +170,17 @@ func TestDifficultyMapping(t *testing.T) {
 // has to be able to show that canonicalization changed the player's text, so
 // the raw input must survive onto the wire.
 func TestPlayedWordKeepsTypedInput(t *testing.T) {
-	m := game.Move{Word: "hòa bình", Typed: "hoà bình", Syllables: 2, Points: 2}
+	m := game.Move{Player: "p2", Word: "hòa bình", Typed: "hoà bình", Syllables: 2, Points: 2}
 
 	mine := PlayedWord(m, true, nil)
 	if mine.GetWord() != "hòa bình" || mine.GetTyped() != "hoà bình" {
 		t.Errorf("canonical/typed pair lost: word=%q typed=%q", mine.GetWord(), mine.GetTyped())
 	}
+	// The byline in a room of three or four is drawn from this field alone;
+	// by_me only says whether it was the recipient.
+	if mine.GetPlayerId() != "p2" {
+		t.Errorf("player_id lost: got %q", mine.GetPlayerId())
+	}
 	if !mine.GetByMe() || mine.GetSyllables() != 2 || mine.GetPoints() != 2 {
 		t.Errorf("unexpected rendering: %+v", mine)
 	}