web: fix OIDC navigation intercepted by the SPA router; tidy table layout

- Login/Logout anchors now carry rel="external": sycamore-router
  intercepts same-origin anchor clicks otherwise, so the OIDC login
  round-trip never left the SPA (found with a real browser test)
- Opponents' hidden hands render as a tidy 5x2 grid of card backs, seats
  have a fixed height and shrink-wrap so the table no longer jumps as
  cards are played
- Dockerfile: cache the Rust target dir so frontend rebuilds are fast
- ignore .playwright-mcp/ tooling output

web/src/pages/lobby.rs

@@ -54,7 +54,10 @@ pub fn LobbyPage() -> View {
                 Some(None) => view! {
                     div(class="panel login-panel") {
                         p { "Log in with your account to play." }
-                        a(class="button primary", href="/auth/login") { "Log in" }
+                        // rel="external" opts out of the SPA router's click
+                        // interception: this must be a full page navigation
+                        // to the backend's OIDC login endpoint.
+                        a(class="button primary", href="/auth/login", rel="external") { "Log in" }
                     }
                 },
                 Some(Some(me)) => view! {
@@ -63,7 +66,7 @@ pub fn LobbyPage() -> View {
                             span(class="whoami") { "Signed in as " strong { (me.name.clone()) } }
                             a(href="/history") { "My matches" }
                             a(href="/leaderboard") { "Leaderboard" }
-                            a(href="/auth/logout") { "Log out" }
+                            a(href="/auth/logout", rel="external") { "Log out" }
                         }
                         div(class="panel") {
                             h2 { "New match" }