Rewrite the backend in Rust with Axum

Replace the Python/kaya server in server/ with a Rust Cargo workspace of
three crates mirroring the old layout: tavolo-platform (lobby API, live-game
store, websocket endpoint, deadline scheduler, stats/Elo, OIDC sessions),
tavolo-scopone (pure scopone scientifico rules plus the platform adapter)
and tavolo-app (composition root and the `tavolo` binary with
serve/migrate/backfill-elo).

The HTTP and WebSocket contracts, error messages, Redis key layout and
Postgres schema are unchanged, so the existing web/ frontend and in-flight
games keep working. Notable differences: sessions are JSON under
tavolo:session: (Python pickle sessions invalidate once), LOGGING_CONFIG is
ignored in favour of RUST_LOG, DATABASE_URL must be Postgres, sqlx migrations
replace aerich, and OpenTelemetry exports Rust process metrics instead of
CPython gc metrics (no Postgres/Redis client instrumentation).

Docker Compose and the Kubernetes manifest now run the single Rust image
(embedded migrations, /static and /assets served by the app); the release CI
keeps building server/Dockerfile. The full test suite (scopone rules,
platform store/deadlines/stats/websockets, OIDC login flow, scopone e2e) is
ported and runs with cargo test --workspace; Redis/Postgres integration tests
are gated on TEST_REDIS_URL/TEST_DATABASE_URL.

README.md

@@ -3,11 +3,11 @@
 A platform for multiplayer card games. The first game is **scopone
 scientifico** — the four-player, fixed-partnership Italian card game:
 
-- **`server/`** — backend: Python + [kaya](https://github.com/woggioni/kaya)
-  framework, OIDC login, live games in Redis, match statistics in Postgres.
-  A monorepo of three distributions sharing the `tavolo` namespace: the
-  game-independent `tavolo-platform`, the scopone game `tavolo-scopone`,
-  and the `tavolo-app` composition root wiring them together.
+- **`server/`** — backend: Rust + [Axum](https://github.com/tokio-rs/axum),
+  OIDC login, live games in Redis, match statistics in Postgres. A Cargo
+  workspace of three crates: the game-independent `tavolo-platform`, the
+  scopone game `tavolo-scopone`, and the `tavolo-app` composition root
+  (the `tavolo` binary: `serve`, `migrate`, `backfill-elo`).
   See [server/README.md](server/README.md).
 - **`web/`** — frontend: Rust + [Sycamore](https://sycamore.dev) compiled to
   WebAssembly, built with [Trunk](https://trunkrs.dev) and styled with
@@ -58,14 +58,16 @@ Backend (from `server/`):
 
 ```sh
 cd server
-python3 -m venv .venv
-.venv/bin/pip install -r requirements.txt
-.venv/bin/pip install -e ./packages/tavolo-platform -e ./packages/tavolo-scopone -e './packages/tavolo-app[dev]'
-.venv/bin/python -m unittest discover -s tests -t .
-.venv/bin/python -m unittest discover -s packages/tavolo-platform/tests
-.venv/bin/python -m unittest discover -s packages/tavolo-scopone/tests
+cargo test --workspace                  # unit + integration suites
+cargo run -p tavolo-app                 # serves on :8080 (Postgres required)
+cargo run -p tavolo-app -- migrate      # apply the embedded sqlx migrations
 ```
 
+The Redis- and Postgres-backed tests run when `TEST_REDIS_URL` /
+`TEST_DATABASE_URL` point at throwaway services (e.g. from
+`docker compose up postgres redis` plus the port mappings) and are skipped
+otherwise.
+
 Frontend (from `web/`), with the backend running on :8080:
 
 ```sh
@@ -84,7 +86,7 @@ OIDC_0_CLIENT_ID=tavolo \
 OIDC_0_REDIRECT_URI=http://localhost:8080/auth/default/callback \
 OIDC_0_POST_LOGIN_REDIRECT=http://localhost:8000/ \
 OIDC_0_POST_LOGOUT_REDIRECT=http://localhost:8000/ \
-  .venv/bin/granian --host 127.0.0.1 --port 8080 tavolo.app:app
+  cargo run -p tavolo-app
 ```
 
 Card images are committed under `web/assets/cards/`; `web/fetch-cards.sh`