Validate operation route parameters and enforce age-appropriate topics

## Problem

Practice and challenge cast the raw `?op=` query string to `Operation` without runtime validation. Visiting `/game/practice?op=anything` passes an unsupported value into `generateQuestion()`, whose switch has no default, so it returns `undefined` and the game crashes. Valid but age-inappropriate operations can also bypass the game hub by editing the URL.

## Proposed scope

- Add a shared runtime parser/type guard for operations.
- Validate the requested operation against the active profile's age-group allowlist.
- Choose a predictable failure path: safe default with notice, or redirect to topic selection.
- Make `generateQuestion()` fail explicitly for invalid input rather than returning implicitly.
- Apply the same validation at every route/session entry boundary.

## Acceptance criteria

- Missing, malformed, repeated, URL-encoded, and unsupported `op` values never crash rendering.
- Direct URLs cannot start an age-inappropriate topic without an explicit product-approved override.
- Valid operations continue to deep-link correctly.
- TypeScript enforces an exhaustive generator switch.
- Route/component tests cover all six operations and invalid inputs.