Add Sycamore/WASM frontend and restructure into server/ + web/

Repo is now a monorepo:

- server/: the kaya backend, unchanged in behaviour, plus:
  - GET /api/me for SPA session detection
  - last_move recorded on every play and broadcast in the game state, so
    clients can show who played which card the moment they play it
  - legal_moves per hand card for the player on turn (rules stay
    server-side)
  - static catch-all route serving the compiled SPA with index.html
    fallback; Tortoise context now bound only for /api/* requests
  - configurable OIDC post-login/logout redirects for dev against trunk
- web/: Sycamore 0.9 + WASM frontend (trunk): login via the OIDC flow,
  lobby (create match / join by code), live game page over websocket with
  card images (CC0 woodcut napoletane deck), capture picker, move banner,
  game-over overlay, match history and leaderboard pages
- server/Dockerfile gains a rust+trunk stage building web/dist; the single
  app image serves the SPA; compose builds from the repo root with
  overridable ports/OIDC env

Verified end-to-end against the compose stack: four OIDC logins, game
creation, three joins by code, websocket play with broadcasts to all
players and out-of-turn rejection. 51 backend tests, mypy and cargo tests
all green.

server/requirements.txt

@@ -0,0 +1,99 @@
+#
+# This file is autogenerated by pip-compile with Python 3.14
+# by the following command:
+#
+#    pip-compile --allow-unsafe --extra-index-url=https://pypi.org/simple --index-url=https://gitea.woggioni.net/api/packages/woggioni/pypi/simple --no-index --output-file=requirements.txt pyproject.toml
+#
+--index-url https://gitea.woggioni.net/api/packages/woggioni/pypi/simple
+--extra-index-url https://pypi.org/simple
+
+aerich==0.10.1
+    # via scopa (pyproject.toml)
+aiosqlite==0.22.1
+    # via tortoise-orm
+anyio==4.15.1
+    # via
+    #   aerich
+    #   httpx
+    #   tortoise-orm
+asyncclick==8.4.2.1
+    # via aerich
+asyncpg==0.31.0
+    # via scopa (pyproject.toml)
+certifi==2026.7.22
+    # via
+    #   httpcore
+    #   httpx
+cffi==2.1.1
+    # via cryptography
+click==8.5.0
+    # via granian
+cryptography==50.0.1
+    # via pyjwt
+dictdiffer==0.10.0
+    # via aerich
+granian==2.8.3
+    # via
+    #   kaya-rsgi
+    #   scopa (pyproject.toml)
+h11==0.16.0
+    # via httpcore
+httpcore==1.0.9
+    # via httpx
+httpx==0.28.1
+    # via
+    #   kaya-oidc
+    #   scopa (pyproject.toml)
+idna==3.19
+    # via
+    #   anyio
+    #   httpx
+iso8601==2.1.0
+    # via tortoise-orm
+kaya-core==0.0.3
+    # via
+    #   kaya-oidc
+    #   kaya-openapi
+    #   kaya-rsgi
+    #   kaya-session
+    #   scopa (pyproject.toml)
+kaya-oidc==0.0.3
+    # via scopa (pyproject.toml)
+kaya-openapi==0.0.3
+    # via scopa (pyproject.toml)
+kaya-rsgi==0.0.3
+    # via scopa (pyproject.toml)
+kaya-session==0.0.3
+    # via
+    #   kaya-oidc
+    #   kaya-session-redis
+    #   scopa (pyproject.toml)
+kaya-session-redis==0.0.3
+    # via scopa (pyproject.toml)
+pwo==0.1.2
+    # via
+    #   kaya-core
+    #   kaya-rsgi
+    #   kaya-session
+    #   scopa (pyproject.toml)
+pycparser==3.0
+    # via cffi
+pyjwt[crypto]==2.14.0
+    # via
+    #   kaya-oidc
+    #   scopa (pyproject.toml)
+pypika-tortoise==0.6.5
+    # via tortoise-orm
+redis==8.1.0
+    # via
+    #   kaya-session-redis
+    #   scopa (pyproject.toml)
+tortoise-orm==1.1.8
+    # via
+    #   aerich
+    #   scopa (pyproject.toml)
+typing-extensions==4.16.0
+    # via
+    #   anyio
+    #   kaya-core
+    #   pwo