Address code review comments: fix asset paths, harden security, improve documentation

[Copilot]

Addresses 6 issues flagged in automated code review covering asset path bugs, security vulnerabilities, and unclear configuration documentation.

Asset Path Corrections

• Fixed DeerMeat.java using chicken.png instead of deerMeat.png
• Aligned stone.py client to use stone.png matching server (was stone_item.png)

Security Hardening

• Removed localhost:8080 from CORS allowed origins (prevents self-XSS attacks)
• Changed compose-db-only.yml to require explicit POSTGRES_PASSWORD (no weak default)
• Enhanced backup-db.sh password validation:
  • Case-insensitive blacklist matching
  • Expanded weak password list (password123, admin123, roam123, roamdev, etc.)
  • Safe variable expansion handling for ${DB_USER} and ${DB_NAME}

Documentation

• Clarified application.yml auto-save comment with explicit tradeoff: manual saves required when disabled, data loss risk on crashes

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.