Enforce multiplayer session capacity

[tyl-droid]

Summary

• reject new players when a game session reaches MaxCapacity
• report the correct IsFull state to clients
• prevent rejected joins from removing players from their current session
• prevent duplicate session membership and clean up stale duplicates on disconnect
• return InsufficientSpace from game-session routes when a join is rejected

Verification

• bun test src/sessions.test.ts — 5 passed
• verified zero-capacity sessions reject joins and report IsFull: true
• git diff --check