Add Sycamore/WASM frontend and restructure into server/ + web/

Repo is now a monorepo:

- server/: the kaya backend, unchanged in behaviour, plus:
  - GET /api/me for SPA session detection
  - last_move recorded on every play and broadcast in the game state, so
    clients can show who played which card the moment they play it
  - legal_moves per hand card for the player on turn (rules stay
    server-side)
  - static catch-all route serving the compiled SPA with index.html
    fallback; Tortoise context now bound only for /api/* requests
  - configurable OIDC post-login/logout redirects for dev against trunk
- web/: Sycamore 0.9 + WASM frontend (trunk): login via the OIDC flow,
  lobby (create match / join by code), live game page over websocket with
  card images (CC0 woodcut napoletane deck), capture picker, move banner,
  game-over overlay, match history and leaderboard pages
- server/Dockerfile gains a rust+trunk stage building web/dist; the single
  app image serves the SPA; compose builds from the repo root with
  overridable ports/OIDC env

Verified end-to-end against the compose stack: four OIDC logins, game
creation, three joins by code, websocket play with broadcasts to all
players and out-of-turn rejection. 51 backend tests, mypy and cargo tests
all green.

web/src/components/card.rs

@@ -0,0 +1,21 @@
+//! Card rendering helpers (plain functions returning views).
+use sycamore::prelude::*;
+
+use crate::model::{card_asset, card_label, CARD_BACK};
+
+/// Render a card image at a given size class (`mini`, `move-card`,
+/// `hand-card`, `table-card`).
+pub fn card_img(code: String, class: &'static str) -> View {
+    let src = card_asset(&code);
+    let alt = card_label(&code);
+    view! {
+        img(src=src, class=format!("card-img {class}"), alt=alt, draggable="false")
+    }
+}
+
+/// Render the back of a card (used for opponents' hidden hands).
+pub fn card_back(class: &'static str) -> View {
+    view! {
+        img(src=CARD_BACK, class=format!("card-img {class}"), alt="card back", draggable="false")
+    }
+}