There are low voltage transzorbs available.
The lowest is meant for 5V lines and can be used as pre-clamping followed by another resistor and some zener diodes doing the secondary clamping down to 3.3 or 2.7V.
The idea here being that a transzorb can normally dissipate much more power then a zener so any spikes/over-voltage is primarily and mostly attenuated down to 5V by the transzorb then "tamed" a bit more by the zeners.
I have uploaded a schematic here:
Some may say it"s a bit of an overkill, but the cost of the extra components and a bit of PCB area, it"s much better then toasting your Pi.
Transzorbs and TVS devices are pretty much the same thing.
Another option is to use BAV99 diodes between the I/O line and +V and also GND as being used on the Raspberry Pi boards.
A polyfuse can be used on an experimenting board to protect the supply if this is available for the experimenter to add extra circuitry of their own and would need a supply.
A polyfuse can be used on a I/O line but only ones that have a low impedance drive.
There are polyfuses available for currents as low as 50mA.
As far as optos go, the amount of "drive" needed for the LED is pretty much dependent on the current transfer function/gain of the opto, consult the datasheet for this spec.
As an example, the cheap and cheerful 4N25 requires 10mA.
This current could be reduced slightly when the opto is driving "light" loads such as the Pi"s I/O lines with either the pull up or down resistors activated.
The anti-parallel diode I mentioned, is to protect the opto"s LED against high reverse voltages which could be encountered from the "outside world".
Again the datasheet would give this limit.
It"s best to use "beefier" diodes here such as the 1N4007 or even the 1N5408 and avoid the 1N4148 or 1N914 type diodes.
Driving mains loads is always a bit tricky when it comes to kids and inexperienced users and is best avoided.
Not only is the safety issue of the user/s of paramount importance, but there are also RFI/EMI and isolation criteria in most countries that must be met with mains interfacing.
Yes you are correct that people will try do crazy things with the Pi and mains stuff.
I recall as a kid I had the bright (or should that be dim) idea of varying the brightness of a mains bulb by simply using a rheostat, after all who needs a proper dimmer using triacs and the such.
Needless to say it vaporized instantly leaving a smoldering metal shaft and the room smelt of burnt carbon for hours afterwards.