fix: address post-audit review findings across docs and source

fix(models): remove duplicate validation in DifficultySettings

refactor(dead-code): remove unused PlayerStats Pydantic model

Fix CI failures: type annotations, linting, and coverage threshold

Refactor app with security fixes, error handling, and type safety