Add resource limits, abuse protection and overload handling

Running games always continue; new work is refused when there is no
capacity; abuse is rejected immediately.

- Docker: CPU/memory/pids caps per container (overridable in .env);
  uvicorn message size, queue and concurrency limits
- Server abuse limits: connections total/per IP (close 1013), message
  rate per connection (token bucket, close 1008 on floods), lobby
  creation rate per IP
- Load monitor: event loop lag, CPU of the own cgroup quota and
  throttling, with hysteresis (normal/busy/overloaded, severe lag
  overloads immediately)
- Admission control: create_lobby and start_game refused while
  overloaded or MAX_ACTIVE_GAMES are running; server_status message
  broadcast on changes; /health reports load but stays ok
- AI bridge: timeout sent with requests, in-flight cap, circuit breaker
- AI service: bounded workers and queue ("overloaded"), drops expired
  requests, degrades to the heuristic agent when busy or too slow
- Website: busy notices, Create/Start disabled when not accepting
  games, slow retry when the server is full
- Tests for limiters, load levels, admission control and AI service
  limits; docs updated

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

wizard_server/tests/conftest.py

@@ -0,0 +1,26 @@
+import contextlib
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.config import Settings
+from app.main import create_app
+from helpers import TEST_SETTINGS
+
+
+@pytest.fixture
+def make_client():
+    """Factory: ``make_client(**settings_overrides)`` returns a started TestClient."""
+    with contextlib.ExitStack() as stack:
+        def factory(**overrides):
+            settings = Settings(**{**TEST_SETTINGS, **overrides})
+            test_client = stack.enter_context(TestClient(create_app(settings)))
+            # Websocket sessions are closed before the app stops (entered later, exited first).
+            test_client.sockets = stack.enter_context(contextlib.ExitStack())
+            return test_client
+        yield factory
+
+
+@pytest.fixture
+def client(make_client):
+    return make_client()