fix: validate time_control against allowed enum values (#schema-2)

Sanitize time_control to rapid_10_0 if not in the allowed list.
Prevents garbage values from reaching the database.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

api/game.php

@@ -83,6 +83,8 @@ function handleStart($db, string $userId, array $input): void {
     $gameKey = $input['game_key'] ?? 'chess';
     $mode = $input['mode'] ?? 'bot';
     $timeControl = $input['time_control'] ?? 'rapid_10_0';
+    $validTimeControls = ['bullet_1_0','bullet_2_1','blitz_3_0','blitz_3_2','blitz_5_0','blitz_5_3','rapid_10_0','rapid_10_5','rapid_15_10','classical_30_0','classical_30_20','standard'];
+    if (!in_array($timeControl, $validTimeControls, true)) $timeControl = 'rapid_10_0';
     $opponentId = $input['opponent_id'] ?? null;
     $botId = $input['bot_id'] ?? null;