Add Sycamore/WASM frontend and restructure into server/ + web/

Repo is now a monorepo:

- server/: the kaya backend, unchanged in behaviour, plus:
  - GET /api/me for SPA session detection
  - last_move recorded on every play and broadcast in the game state, so
    clients can show who played which card the moment they play it
  - legal_moves per hand card for the player on turn (rules stay
    server-side)
  - static catch-all route serving the compiled SPA with index.html
    fallback; Tortoise context now bound only for /api/* requests
  - configurable OIDC post-login/logout redirects for dev against trunk
- web/: Sycamore 0.9 + WASM frontend (trunk): login via the OIDC flow,
  lobby (create match / join by code), live game page over websocket with
  card images (CC0 woodcut napoletane deck), capture picker, move banner,
  game-over overlay, match history and leaderboard pages
- server/Dockerfile gains a rust+trunk stage building web/dist; the single
  app image serves the SPA; compose builds from the repo root with
  overridable ports/OIDC env

Verified end-to-end against the compose stack: four OIDC logins, game
creation, three joins by code, websocket play with broadcasts to all
players and out-of-turn rejection. 51 backend tests, mypy and cargo tests
all green.

server/.env.example

@@ -0,0 +1,25 @@
+# Postgres
+POSTGRES_HOST=localhost
+POSTGRES_PORT=5432
+POSTGRES_DB=scopa
+POSTGRES_USER=scopa
+POSTGRES_PASSWORD=scopa
+DATABASE_URL=postgres://scopa:scopa@localhost:5432/scopa
+
+# OIDC (mock-oauth2-server in dev; it does not validate clients, so any
+# client id/secret works. For a real IdP like Keycloak, use its values here.)
+OIDC_ISSUER=http://localhost:8180/scopa
+OIDC_CLIENT_ID=scopa
+OIDC_CLIENT_SECRET=dev-secret
+OIDC_REDIRECT_URI=http://localhost:8080/auth/callback
+
+# Redis (session and live-game storage). Unset to fall back to in-memory
+# stores (only sensible for local development with a single worker).
+REDIS_URL=redis://localhost:6379/0
+
+# How long a live game survives in Redis without activity.
+GAME_TTL_SECONDS=86400
+
+# App server
+APP_HOST=0.0.0.0
+APP_PORT=8080