Implement player exit: invalidate session, shred cards, advance initiative

[Copilot]

Exiting a game was a no-op — clicking "exit" just navigated home without touching server state, leaving the player's session key live, their cards in play, and their initiative slot active.

Changes

New SQL query

• GameCardsShredByPlayer — bulk-shreds all cards held by a player in a game

Exit action handler (actions.go)

• Added exit case handled before the game-state switch so it works in any state
• Shreds all of the player's cards
• If it's the player's turn (stateTurn / statePending), resets statePending → stateTurn if needed, then calls advanceTurn before deletion (so InitiativeAdvance still sees the correct max initiative)
• Deletes the player from game_players — their slot becomes a gap the existing advanceTurn gap-handler already tolerates
• Expires the session cookie (MaxAge: -1, HttpOnly: true) and responds with HX-Redirect: /

Footer template (tmpl.footer.html)

• Exit dialog's confirmation button changed from a plain <a href="/"> to hx-post="/{game_id}/action/exit" so the server-side cleanup runs before the redirect

Security / correctness

• Added math.MaxInt32 bounds check on the player ID parsed from the cookie before casting to int32

[katlukens]

lgtm