fix(engine): add input validation found during dogfooding

- Validate category names in Score() against AllCategories
- Validate dice indices in Hold() are within 0-4 range
- Skip zero-value dice in counts() to prevent false Yahtzee on unrolled dice
- Panic on NewGame with 0 players to prevent index-out-of-range

Author: edge2992

engine/category.go

@@ -26,5 +26,14 @@ var AllCategories = []Category{
 
 var UpperCategories = []Category{Ones, Twos, Threes, Fours, Fives, Sixes}
 
+func IsValidCategory(c Category) bool {
+	for _, cat := range AllCategories {
+		if cat == c {
+			return true
+		}
+	}
+	return false
+}
+
 const UpperBonusThreshold = 63
 const UpperBonusValue = 35

engine/game.go

@@ -53,6 +53,9 @@ type PlayerState struct {
 }
 
 func NewGame(playerNames []string, src rand.Source) *Game {
+	if len(playerNames) == 0 {
+		panic("NewGame requires at least 1 player")
+	}
 	if src == nil {
 		src = rand.NewSource(time.Now().UnixNano())
 	}
@@ -95,6 +98,11 @@ func (g *Game) Hold(indices []int) error {
 	if g.RollCount >= MaxRolls {
 		return errors.New("cannot hold: max rolls reached")
 	}
+	for _, idx := range indices {
+		if idx < 0 || idx > 4 {
+			return fmt.Errorf("cannot hold: index %d out of range (0-4)", idx)
+		}
+	}
 	g.Dice = Reroll(g.Dice, indices, g.rng)
 	g.RollCount++
 	if g.RollCount >= MaxRolls {
@@ -110,6 +118,9 @@ func (g *Game) Score(category Category) error {
 	if g.RollCount == 0 {
 		return errors.New("cannot score: must roll first")
 	}
+	if !IsValidCategory(category) {
+		return fmt.Errorf("cannot score: invalid category %q", category)
+	}
 	player := &g.Players[g.Current]
 	if player.Scorecard.IsFilled(category) {
 		return fmt.Errorf("cannot score: category %s already filled", category)

engine/scoring.go

@@ -73,7 +73,9 @@ func sum(dice [5]int) int {
 func counts(dice [5]int) map[int]int {
 	m := make(map[int]int)
 	for _, d := range dice {
-		m[d]++
+		if d > 0 {
+			m[d]++
+		}
 	}
 	return m
 }