chore: address Plan 4 deferred-minors (stale-cookie cleanup pass)

- Rename $secret to $csrfSecret in public/index.php to make
  intent clear at every call site; the value is the CSRF/turn-token
  HMAC key, not just 'the secret'.
- Drop the stale 'Configure the router with the eight routes' comment
  in public/index.php; the router now has sixteen routes.
- Drop the duplicate .bf-toast rule in public/assets/styles.css; the
  second declaration (the new yellow box) is the active one, the
  first (legacy green pill) is dead code from the editor era.
- Add a trailing newline to src/Views/home.php.
- Tighten the matchId regex in two tests from {16,} to {16} since
  bin2hex(random_bytes(8)) always produces exactly 16 hex chars; the
  spec's {16,} stays in production TurnToken.

No behavior changes; addresses the deferred-minors parked during
per-task review.

src/Views/home.php

@@ -27,4 +27,4 @@ render_layout(static function () use ($csrf, $bundled): void {
     <div id="recent"><p class="bf-empty">No saved scenarios yet.</p></div>
     <script type="module" src="<?= $a('/js/storage.js') ?>"></script>
     <?php
-}, $csrf, 'BattleForge');
+}, $csrf, 'BattleForge');