Add server security hardening and draft quiz persistence

Security:
- Add AES-256-GCM encryption for user PII (email, API keys, config)
- Add rate limiting (helmet + express-rate-limit)
- Require auth for file uploads

UX:
- Persist draft quizzes to sessionStorage (survives refresh)
- Add URL-based edit routes (/edit/draft, /edit/:quizId)
- Fix QuizEditor async defaultConfig race condition
- Fix URL param accumulation in Landing

hooks/useQuizLibrary.ts

@@ -71,8 +71,12 @@ export const useQuizLibrary = (): UseQuizLibraryReturn => {
           : 'Failed to load quiz.';
         throw new Error(errorText);
       }
+      const data = await response.json();
       toast.success('Quiz loaded!');
-      return response.json();
+      return {
+        ...data,
+        config: data.gameConfig,
+      };
     } catch (err) {
       const message = err instanceof Error ? err.message : 'Failed to load quiz';
       if (!message.includes('redirecting')) {