fix: reconstruct server.js message pipeline (closes #191)

[ayomidemariam]

Summary

Reconstructs src/server.js to meet all requirements specified in issue #191.

Changes

• Added createRateLimiter import from ./rate-limiter.js for per-message rate limiting
• Added safeSend(ws, data) helper function for all outbound messages with error handling
• Implemented per-message rate limiting check before validation (drops messages from rate-limited clients)
• Added rateLimiter.remove(actualClientId) on disconnect to clean up rate limit state
• Removed ipConnectionCount and server from the return value (only returns { wss, rooms } as specified)

What was missing

The original server.js was missing:

1. createRateLimiter import — per-message rate limiting was not implemented
2. safeSend function — outbound messages had no error handling wrapper
3. Rate limit state cleanup on disconnect
4. The return value exposed internal state (ipConnectionCount, server) that should not be public

Acceptance Criteria

• src/server.js exports exactly one createServer function
• No SyntaxError when importing src/server.js
• npm run lint passes with zero errors
• npm test passes: all 18 test suites green (163 tests passed, 15 skipped postgres)
• server.test.js: all 12 tests pass
• binary-frames.test.js: all 4 tests pass
• conn-rate-limiter.test.js: all 6 tests pass
• max-connections.test.js: all 4 tests pass

Testing

All 18 test suites pass with 163 tests. No test files were modified. No new dependencies were added.