web: fix OIDC navigation intercepted by the SPA router; tidy table layout

- Login/Logout anchors now carry rel="external": sycamore-router
  intercepts same-origin anchor clicks otherwise, so the OIDC login
  round-trip never left the SPA (found with a real browser test)
- Opponents' hidden hands render as a tidy 5x2 grid of card backs, seats
  have a fixed height and shrink-wrap so the table no longer jumps as
  cards are played
- Dockerfile: cache the Rust target dir so frontend rebuilds are fast
- ignore .playwright-mcp/ tooling output

web/style.css

@@ -252,6 +252,13 @@ table.matches td.lost {
     border-radius: 10px;
     padding: 0.5rem 0.75rem;
     text-align: center;
+    /* Fixed height keeps the table from jumping as cards are played. */
+    display: flex;
+    flex-direction: column;
+    justify-content: flex-start;
+    min-height: 116px;
+    align-self: center;
+    width: 100%;
 }
 
 .seat.active {
@@ -275,9 +282,19 @@ table.matches td.lost {
     color: var(--muted);
 }
 
+/* Opponents' hidden hands: a tidy grid so the count reads at a glance. */
+.seat-cards {
+    display: grid;
+    grid-template-columns: repeat(5, auto);
+    gap: 2px;
+    justify-content: center;
+    margin: 0.35rem 0;
+}
+
 .seat-stats {
     font-size: 0.8rem;
     color: var(--muted);
+    margin-top: auto;
 }
 
 .center {
@@ -287,6 +304,7 @@ table.matches td.lost {
     align-items: center;
     justify-content: center;
     gap: 0.75rem;
+    min-height: 230px;
 }
 
 .table-cards {
@@ -313,7 +331,7 @@ table.matches td.lost {
 }
 
 .card-img.mini {
-    height: 46px;
+    height: 34px;
 }
 
 .card-img.move-card {
@@ -334,6 +352,8 @@ table.matches td.lost {
     flex-wrap: wrap;
     gap: 0.5rem;
     justify-content: center;
+    align-items: flex-end;
+    min-height: 132px;
 }
 
 .hand-slot {