fix: resolve security/correctness review + AAA graphics pass

Backend (Tier 0/1/3): single-payout double-pay -> needs_review; admin-retry tx_hash guard; UNIQUE index on games.payment_id (migration 023) + atomic claim; reconnect no longer resets block-timeout; completeGame keys on user_id+dungeon_seed (not socket_id); token-gated /api/user/:socketId/* endpoints; payout min/max enforcement; orphaned-active-game boot recovery; sessionManager cleanup FK fix; XFF rightmost-hop; global uncaughtException/unhandledRejection guard; server binds 127.0.0.1; provably-fair client-seed (HMAC) + RNG [0,1) bound; difficulty preset ranges reach the digger; chat no longer leaks full socket.id; removed dangerous-keyword SQL theater.

Match mode (Tier 2, still MATCH_ENABLED-gated): fixed match_queue/match_move crash paths + scheduler dead-code + leaked ceiling timer; pot collected before start with abort+refund; BigInt/basis-point fee math, capped payout; no-address winner claimable; winnerId==placement[0]; finalize schema + payout-first isolation; reconnect re-key with ownership; refunds on all cancel paths; real countdown; map/timer cleanup. +16 tests.

Graphics: new overlay FX layer (torch light, vignette, embers, sparkle/burst/flash/shake, self-suspending rAF); gameplay juice; atmospheric screens; CSS design-token chrome with framed modals; richer Kenney tile renderer; imported Kenney dungeon/interior sheets + fx particles.

Verification: 45 suites / 312 tests pass; 40 changed JS files parse; 20 server modules load clean; no regressions.

src/db/databaseManager.js

@@ -11,13 +11,6 @@ const path = require('path');
  * Query validator to detect potential SQL injection
  */
 class QueryValidator {
-    constructor() {
-        this.dangerousKeywords = [
-            'DROP', 'DELETE', 'TRUNCATE', 'ALTER', 'CREATE', 'REPLACE',
-            'EXEC', 'EXECUTE', 'SCRIPT', '--', '/*', '*/', 'XP_', 'SP_'
-        ];
-    }
-
     isSafe(text, params) {
         // Check if using parameterized query properly
         // Count unique placeholders ($1, $2, etc.) — PostgreSQL allows reusing $1 multiple times
@@ -29,29 +22,6 @@ class QueryValidator {
             return false;
         }
 
-        // Check for dangerous patterns in the query text itself
-        for (const keyword of this.dangerousKeywords) {
-            // Use regex to avoid false positives (e.g., "DESCRIPTION" containing "SCRIPT")
-            // Alphanumeric keywords use word boundaries; others use literal match
-            let regex;
-            if (/^[A-Z0-9_]+$/i.test(keyword)) {
-                regex = new RegExp(`\\b${keyword}\\b`, 'i');
-            } else {
-                // Escape special characters for literal match
-                const escaped = keyword.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-                regex = new RegExp(escaped, 'i');
-            }
-
-            if (regex.test(text)) {
-                // Allow legitimate DDL in migrations only
-                const stack = new Error().stack;
-                if (!stack.includes('migrations')) {
-                    console.warn(`⚠️ Potentially dangerous keyword "${keyword}" in query`);
-                    // Log but don't block - some keywords might be legitimate
-                }
-            }
-        }
-
         return true;
     }