feat(backend): per-tier, per-kind active-game limits with a guest funnel

Cap a player's simultaneous unfinished games per kind (vs_ai, random,
friends) with independent guest and durable-account tiers, held in a new
single-row backend.config table (-1 = unlimited) behind an in-memory cache
and editable live in the admin console (/_gm/limits). Each game is tagged
with games.game_kind on creation.

This replaces the earlier flat MaxActiveQuickGames=10 combined cap: the
per-tier/kind config is the single mechanism, enforced at the same handler
gate (ensureUnderGameLimit by kind on lobby/enqueue) plus the durable
friends cap in CreateInvitation. game.Service.AtGameLimit only resolves the
tier and counts; the limit policy stays at the request edge.

Guests are now refused friend requests, friend-code redemption,
befriend-in-game and invitation creation outright (403 guest_forbidden) --
previously only the UI hid these.

Admin: a kind column in both game lists and the config editor.

Defaults: guest 1 vs_ai / 1 random / 0 friends; durable 10 / 10 / 10.

backend/internal/adminconsole/views.go

@@ -312,6 +312,8 @@ type GameRow struct {
 	UpdatedAt string
 	// VsAI marks an honest-AI game (rendered as 🤖 in the list's AI column).
 	VsAI bool
+	// Kind is the game's origin tag label: vs_ai / random / friends / unknown.
+	Kind string
 }
 
 // GamesView is the paginated games list, optionally filtered by status.
@@ -321,6 +323,17 @@ type GamesView struct {
 	Pager  Pager
 }
 
+// GameLimitsView is the per-tier, per-kind active-game limit form: each field is a cap where -1
+// is unlimited, 0 blocks the kind, and a positive value caps concurrent games of that kind.
+type GameLimitsView struct {
+	GuestVsAI      int
+	GuestRandom    int
+	GuestFriends   int
+	DurableVsAI    int
+	DurableRandom  int
+	DurableFriends int
+}
+
 // GameDetailView is one game with its seats.
 type GameDetailView struct {
 	ID          string