Engine cleanups (closes #1 #2 #3 #4 #6 #7)

[mellonis]

Sweeps six of the small engine issues filed back in #1–#7. Issue #5 (first-click safety) already landed in earlier work, so it's skipped.

Summary

• Fix off-by-one in Minesweeper.#checkCol / #checkRow #1 Minesweeper.#checkCol / #checkRow used col > #cols instead of col >= #cols. Valid indices are 0..cols-1; col === cols slipped through the guard and crashed on field access. Same off-by-one in #checkRow. Fix: > → >=.
• Add negative bounds checks in #checkIndex / #checkCol / #checkRow #2 None of #checkIndex / #checkCol / #checkRow rejected negative numbers. Number.isInteger(-1) is true and -1 > cols is false, so field[-1] slipped through to a crash. Added explicit < 0 checks.
• Pass isGameEnded=true from #lose() to avoid redundant flood-fills #3 #lose() called cell.reveal() with no arg, so each unrevealed empty cell triggered a zero-neighbour flood-fill cascade — already-revealed cells short-circuited, so the visible result was correct, but it ran thousands of redundant recursive calls per loss. Pass true to skip the per-cell cascade.
• Drop dead isGameOver argument in Minesweeper.reveal() #4 Minesweeper.reveal() passed this.#isGameOver to cell.reveal() after an early-return on this.#isGameOver, so the arg was always false. Dropped.
• Remove redundant !isMarked check in Cell.mark() #6 Cell.mark()'s second branch had if (!#isRevealed && !#isMarked), but the first branch already returns when #isMarked is true. Dropped the tautological !#isMarked.
• Make win check O(1) by tracking #revealedCount #7 Win check iterated the entire field on every reveal. Cell.reveal() now returns the count of newly-revealed cells (summing the transitive flood-fill reveals); Minesweeper tracks #revealedCount and wins when it equals cols*rows - mines. cell.isMine via the existing getter replaces the previous boolean return as the lose signal. Two test assertions updated to match the new number return.

Test plan

• npm run build clean (no type errors)
• npm run lint clean
• npm test — 30/30 passing (test assertions for Cell.reveal's return type updated)
• Manual: tested in browser at http://localhost:5173 prior to push — preset clicks, mid-game reveal, win and lose flows all work as before; no observable behavior change, just less wasted work and tighter validation.

Closes #1, closes #2, closes #3, closes #4, closes #6, closes #7.