engine: realistic config bounds, enforced and served

ConfigBounds (students 10-500, edgesPerNode 1-8, forwardProb 0-0.9,
triangleProb 0-1) caps what RunScenario accepts: a student does not
keep 150 close friendships and a guaranteed forward is not a real
base rate. numEducated gains its missing upper limit (numStudents).
Bounds-side validation also protects the public server from absurd
numStudents values. GET /api/config/default now returns
{config, bounds} so the frontend can drive its controls from the
same numbers; the frontend does not call it yet, so this commit
changes no UI behaviour.

tygo.yaml

@@ -11,8 +11,9 @@ packages:
     include_files:
       - "api.go"
     frontmatter: |
-      import type { Config, Result, Strategy } from "./engine";
+      import type { Bounds, Config, Result, Strategy } from "./engine";
     type_mappings:
+      engine.Bounds: "Bounds"
       engine.Config: "Config"
       engine.Result: "Result"
       engine.Strategy: "Strategy"