Enhance session and host authentication management

[Vianpyro]

• Added functions to manage session tokens, host secrets, and CSRF tokens in api.js.
• Updated joinRoom, changeRole, setRoundConfig, startGame, startNextRound, and resetGame functions to utilize new authentication headers.
• Integrated session token handling in the WebSocket connection.
• Improved error handling and notifications for session management.
• Refactored main.js to use new API functions for game actions.
• Updated JoinRole component to persist host credentials after room creation.
• Cleaned up DOM rendering logic for better readability and maintainability.

Description

• A clear and concise description of the changes introduced in this pull request.

Related Issues

• Closes #ISSUE_NUMBER (if applicable)

Changes Made

• List the main changes made in this PR:
  • Change 1
  • Change 2
  • Change 3

Screenshots (if applicable)

• If applicable, add screenshots to help visualize the changes.

How to Test

• Steps to test the changes:

1. Go to '...'
2. Click on '....'
3. Observe '....'

Checklist

• My code follows the project's coding style.
• I have performed a self-review of my code.
• I have added necessary tests (if applicable).
• I have documented my changes (if necessary).

Additional Context

• Add any other relevant context or notes for reviewers.

[Copilot]

Pull request overview

This PR enhances authentication and security for the Penny Game application by implementing session tokens, host credentials (secrets + CSRF tokens), and rate limiting. The changes introduce token-based authentication for both players and hosts, secure credential storage, and improved WebSocket security.

Key Changes:

• Added session token and CSRF token management on both backend and frontend
• Implemented rate limiting and connection limits for security
• Enhanced WebSocket authentication with token validation
• Refactored API calls to include authentication headers

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
api/app/routes.py	Added session/CSRF token validation, rate limiting, and admin token authentication
api/app/game_logic.py	Implemented token issuance and validation functions
api/app/models.py	Added session_tokens and host_csrf_token fields to PennyGame model
api/app/websocket.py	Added session token validation for WebSocket connections and connection limits
front-end/public/scripts/api.js	Implemented token storage/retrieval and header building functions
front-end/public/scripts/main.js	Refactored to use new API functions with authentication
front-end/src/components/JoinRole.astro	Persists host credentials after room creation
front-end/package-lock.json	Updated dependencies

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.