Rewrite the backend in Rust with Axum

Replace the Python/kaya server in server/ with a Rust Cargo workspace of
three crates mirroring the old layout: tavolo-platform (lobby API, live-game
store, websocket endpoint, deadline scheduler, stats/Elo, OIDC sessions),
tavolo-scopone (pure scopone scientifico rules plus the platform adapter)
and tavolo-app (composition root and the `tavolo` binary with
serve/migrate/backfill-elo).

The HTTP and WebSocket contracts, error messages, Redis key layout and
Postgres schema are unchanged, so the existing web/ frontend and in-flight
games keep working. Notable differences: sessions are JSON under
tavolo:session: (Python pickle sessions invalidate once), LOGGING_CONFIG is
ignored in favour of RUST_LOG, DATABASE_URL must be Postgres, sqlx migrations
replace aerich, and OpenTelemetry exports Rust process metrics instead of
CPython gc metrics (no Postgres/Redis client instrumentation).

Docker Compose and the Kubernetes manifest now run the single Rust image
(embedded migrations, /static and /assets served by the app); the release CI
keeps building server/Dockerfile. The full test suite (scopone rules,
platform store/deadlines/stats/websockets, OIDC login flow, scopone e2e) is
ported and runs with cargo test --workspace; Redis/Postgres integration tests
are gated on TEST_REDIS_URL/TEST_DATABASE_URL.

server/crates/tavolo-platform/src/routes/mod.rs

@@ -0,0 +1,33 @@
+//! The platform's HTTP surface: lobby, stats, auth and health routes.
+//!
+//! Handlers live in submodules mirroring the Python implementation; this
+//! module assembles them into one axum [`Router`].
+
+pub mod auth;
+pub mod games;
+pub mod health;
+pub mod me;
+pub mod openapi;
+pub mod stats;
+
+use axum::routing::get;
+use axum::Router;
+
+use crate::platform::SharedPlatform;
+use crate::ws;
+
+/// All platform routes (HTTP + the live-play websocket).
+///
+/// `providers` lists the configured OIDC provider names; login/callback/
+/// logout routes are registered per provider so unknown provider paths fall
+/// through to the router's fallback.
+pub fn router(providers: &[String]) -> Router<SharedPlatform> {
+    Router::new()
+        .merge(health::routes())
+        .merge(me::routes())
+        .merge(auth::routes(providers))
+        .merge(games::routes())
+        .merge(stats::routes())
+        .merge(openapi::routes())
+        .route("/ws/games/{game_id}", get(ws::game_socket))
+}