It seems like this sort of questions is amazingly popular. I see two similar ones just in the first page here.

But I am so excited about this that I'd like to share my own situation and get some personal advice from you in this crucial first step.

Please :)
__________________

Maybe start out with Java and eventually port to C++, when game features and load exceed Java's performance limits?

Java will be fine for the type of game you suggest. You can probably use that with LibGDX for what you want. https://libgdx.badlogicgames.com/

What about code security? If I keep the game in Java, wouldn't people be able to read the code, clone the game, induce cheats?

Sounds like Java is the way for you to go, if it's useful to you professionally then that's a big deal and Java will do the job just fine (do you know Minecraft was coded in Java?). As Kylotan mentioned, look into using LibGDX, it's a game library for Java.

Compiled code security is virtually a non-concern for the vast majority of applications for the vast majority of developers. And because Java is compiled (and so is C++) the original source code is not available to be read. Of course if you go and host your source on github then anyone can see it anyway.

You can decompile Java and get something very similar to the original source code.

Yes it is true that certain original symbols (e.g classnames and method names) are maintained in the compiled .class files and because Java maps pretty well to the underlying bytecode it means that decompiling bytecode to Java can produce a fairly faithful reproduction of the logic structure.

What I should have been saying is more along the lines of: Because Java is compiled to bytecode rather than interpreted from source, it means the original sourcecode including all symbols, comments, use of generics, etc is not shipped as-is to the client in plaintext for anyone to trivially read in their favourite text editor.

It's quite true that via decompilers you can get fairly workable code out of .class (or .dex) files. Which is much better than what you can get from say, a decompiler and a native lib, which basically will just declare a bunch of variables with register names, assemble something resembling a function declaration with a bunch of void*, and call it a day.

With that said, even if you're making a native game, you have to work out a way so the server can verify the information the client is sending. You can't rely in "oh it's a native file so users wont modify it!" and not check what the client is telling you. So whatever you chose, you'll have to do the legwork all the same and make up a scheme that lets you verify what the client is telling you.

Now if the game is single player, do you honestly care that much that people modify the game? Let them eat cake.