Add Sycamore/WASM frontend and restructure into server/ + web/

Repo is now a monorepo:

- server/: the kaya backend, unchanged in behaviour, plus:
  - GET /api/me for SPA session detection
  - last_move recorded on every play and broadcast in the game state, so
    clients can show who played which card the moment they play it
  - legal_moves per hand card for the player on turn (rules stay
    server-side)
  - static catch-all route serving the compiled SPA with index.html
    fallback; Tortoise context now bound only for /api/* requests
  - configurable OIDC post-login/logout redirects for dev against trunk
- web/: Sycamore 0.9 + WASM frontend (trunk): login via the OIDC flow,
  lobby (create match / join by code), live game page over websocket with
  card images (CC0 woodcut napoletane deck), capture picker, move banner,
  game-over overlay, match history and leaderboard pages
- server/Dockerfile gains a rust+trunk stage building web/dist; the single
  app image serves the SPA; compose builds from the repo root with
  overridable ports/OIDC env

Verified end-to-end against the compose stack: four OIDC logins, game
creation, three joins by code, websocket play with broadcasts to all
players and out-of-turn rejection. 51 backend tests, mypy and cargo tests
all green.

web/fetch-cards.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+# Download the CC0 "woodcut napoletane" card set (traced from a 1902 Naples
+# deck) and rename the files to the card codes the backend uses:
+#   colori/denari-asso.svg -> assets/cards/01D.svg
+#   colori/spade-re.svg    -> assets/cards/10S.svg
+#   colori/dorso.svg       -> assets/cards/back.svg
+#
+# Source: https://github.com/SONDLecT/woodcut-napoletane (CC0 1.0)
+set -eu
+
+BASE="https://raw.githubusercontent.com/SONDLecT/woodcut-napoletane/master/colori"
+OUT="$(dirname "$0")/assets/cards"
+mkdir -p "$OUT"
+
+fetch() {
+    suit="$1"; rank="$2"; code="$3"
+    if [ ! -s "$OUT/$code.svg" ]; then
+        curl -sfL "$BASE/$suit-$rank.svg" -o "$OUT/$code.svg"
+    fi
+}
+
+for suit in denari coppe spade bastoni; do
+    case "$suit" in
+        denari) letter=D ;;
+        coppe) letter=C ;;
+        spade) letter=S ;;
+        bastoni) letter=B ;;
+    esac
+    fetch "$suit" asso "01$letter"
+    for rank in 02 03 04 05 06 07; do
+        fetch "$suit" "$rank" "$rank$letter"
+    done
+    fetch "$suit" fante "08$letter"
+    fetch "$suit" cavallo "09$letter"
+    fetch "$suit" re "10$letter"
+done
+
+if [ ! -s "$OUT/back.svg" ]; then
+    curl -sfL "$BASE/dorso.svg" -o "$OUT/back.svg"
+fi
+
+echo "cards ready in $OUT"