Serve static assets with Granian and add YAML-configurable logging

Granian serves the compiled SPA assets directly in Rust: hashed js/wasm/css
under /static (the release build uses --public-url /static/) and the card
images under /assets, configured with the GRANIAN_STATIC_PATH_ROUTE/MOUNT/
DIR_TO_FILE env vars in the Dockerfile. The Python catch-all now only serves
the SPA shell (index.html) at / and for client-side routes.

Every module logs through getLogger(__name__): lifecycle and business events
at INFO, per-move and store detail at DEBUG. The built-in default writes
DEBUG to the console; LOGGING_CONFIG points at a YAML file in the
logging.config.dictConfig schema to take over the configuration. PyYAML
becomes a direct dependency.

server/Dockerfile

@@ -33,9 +33,12 @@ COPY web/Cargo.toml web/Cargo.lock web/index.html web/style.css web/Trunk.toml .
 COPY web/assets ./assets
 COPY web/src ./src
 
+# --public-url makes trunk emit asset URLs under /static, the prefix Granian
+# serves in the runtime image (see GRANIAN_STATIC_PATH_* below). Dev builds
+# (trunk serve) keep the default "/" public URL.
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/web/target \
-    trunk build --release
+    trunk build --release --public-url /static/
 
 # --- Python builder ----------------------------------------------------------
 FROM alpine:3.24 AS builder
@@ -68,7 +71,12 @@ COPY --from=builder /build/migrations /app/migrations
 # aerich reads [tool.aerich] from pyproject.toml (its default config file);
 # the db-migrate compose service runs `aerich upgrade` with working_dir=/app.
 COPY --from=builder /build/pyproject.toml /app/pyproject.toml
-# The compiled single-page application, served by the backend itself.
+# The compiled single-page application. Granian serves the assets directly
+# in Rust — hashed js/wasm/css under /static/* and the card images under
+# /assets/* (see the GRANIAN_STATIC_PATH_* env vars below; click splits
+# multi-value env vars on whitespace for routes and ':' for paths). The
+# Python app only serves the SPA shell (index.html) at / and for
+# client-side routes (STATIC_DIR).
 COPY --from=web-builder /web/dist /app/web/dist
 
 ENV PATH="/opt/venv/bin:$PATH" \
@@ -77,6 +85,9 @@ ENV PATH="/opt/venv/bin:$PATH" \
     GRANIAN_HOST=0.0.0.0 \
     GRANIAN_PORT=8080 \
     GRANIAN_INTERFACE=rsgi \
+    GRANIAN_STATIC_PATH_ROUTE="/static /assets" \
+    GRANIAN_STATIC_PATH_MOUNT="/app/web/dist:/app/web/dist/assets" \
+    GRANIAN_STATIC_PATH_DIR_TO_FILE=index.html \
     STATIC_DIR=/app/web/dist
 
 USER app