fix: address post-audit review findings across docs and source

fix(logging): replace f-string logging with lazy %s formatting

refactor(dead-code): remove unused GameState and 4 dead functions from session.py

Optimize away team generation and persist in session state to prevent loops

Fix CI failures: type annotations, linting, and coverage threshold

Refactor app with security fixes, error handling, and type safety