Harden /ask helper, UDP replies and run_lua in multiplayer

- Pass the /ask question to claude on stdin so it can't be parsed as a CLI option.
- Block run_lua in multiplayer unless an admin enables the new
  "Allow Lua queries in multiplayer" map setting.
- Ignore UDP packets that don't come from the game's port, in both the
  MCP server and the ask helper.
- Build the screenshot path from our own name instead of the game's reply,
  and restrict screenshot names in the mod.
- Validate ask packets, cap question length and limit concurrent claude runs.
- Replace hard-coded home paths in the README and systemd unit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/claude-co-engineer-ask.service

@@ -2,7 +2,8 @@
 Description=Claude Co-Engineer: answers in-game /ask questions with Claude
 
 [Service]
-ExecStart=/home/faab/Documents/Code/Factorio/claude-co-engineer/server/.venv/bin/claude-co-engineer-ask
+# /path/to/claude-co-engineer is replaced with the repo's location when installing (see README).
+ExecStart=/path/to/claude-co-engineer/server/.venv/bin/claude-co-engineer-ask
 Environment=FACTORIO_UDP_PORT=34200
 Environment=FACTORIO_ASK_PORT=34201
 # Uncomment to force a model for every /ask, ignoring the in-game setting (alias or full model ID):