Fix command prefix bug and audit issues across all new plugins

All new plugins used Base{Client: client} instead of NewBase(client),
leaving Prefix empty so no !commands matched. Also fixes hangman UTF-8
safety (use runes not byte indices), euro race conditions, blackjack
deck/timer bugs, and adds difficulty selection to hangman start.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/plugin/moderation.go

@@ -459,7 +459,7 @@ func NewModerationPlugin(client *mautrix.Client) *ModerationPlugin {
 	}
 
 	return &ModerationPlugin{
-		Base:         Base{Client: client},
+		Base:         NewBase(client),
 		cfg:          cfg,
 		enabled:      enabled,
 		wl:           newWordList(cfg.WordListPath, cfg.WordListVariations),