chore: address Plan 4 deferred-minors (stale-cookie cleanup pass)

- Rename $secret to $csrfSecret in public/index.php to make
  intent clear at every call site; the value is the CSRF/turn-token
  HMAC key, not just 'the secret'.
- Drop the stale 'Configure the router with the eight routes' comment
  in public/index.php; the router now has sixteen routes.
- Drop the duplicate .bf-toast rule in public/assets/styles.css; the
  second declaration (the new yellow box) is the active one, the
  first (legacy green pill) is dead code from the editor era.
- Add a trailing newline to src/Views/home.php.
- Tighten the matchId regex in two tests from {16,} to {16} since
  bin2hex(random_bytes(8)) always produces exactly 16 hex chars; the
  spec's {16,} stays in production TurnToken.

No behavior changes; addresses the deferred-minors parked during
per-task review.

tests/Integration/PostStartMatchTest.php

@@ -39,7 +39,7 @@ final class PostStartMatchTest extends TestCase
         self::assertSame(1, $body['match']['round'] ?? null);
         self::assertCount(6, $body['match']['units'] ?? []);
         self::assertIsString($body['matchId'] ?? null);
-        self::assertMatchesRegularExpression('/^[a-f0-9]{16,}$/', $body['matchId']);
+        self::assertMatchesRegularExpression('/^[a-f0-9]{16}$/', $body['matchId']);
         self::assertIsString($body['turnToken'] ?? null);
         self::assertMatchesRegularExpression('/^[a-f0-9]{32}$/', $body['turnToken']);
     }