Initial scopone scientifico backend

Multiplayer scopone scientifico backend on the kaya framework:

- OIDC login (kaya-oidc), session-backed WebSocket auth
- Pure rules engine (forced captures, scopa, primiera scoring) with
  full-match simulation tests
- Live game state in Redis (JSON + TTL, join codes, per-game locks,
  pub/sub state push); in-memory fallback for tests
- WebSocket /ws/games/{id} for real-time play; REST lobby endpoints
  (create/join/snapshot) with hidden-hand views
- Finished matches persisted to Postgres (Tortoise + aerich) for match
  history and leaderboard endpoints
- Docker Compose stack: postgres, redis, mock-oauth2-server, db-migrate, app
- 45 tests passing; mypy clean

dev/mockoauth/Dockerfile

@@ -0,0 +1,9 @@
+# Dev OIDC provider: navikt/mock-oauth2-server with the scopa test
+# configuration (four ready-made players) baked in. The config is
+# COPYed instead of bind-mounted so this also works against containerized
+# (e.g. rootless/DinD) docker daemons that cannot see the host workspace.
+FROM ghcr.io/navikt/mock-oauth2-server:5.0.2
+
+COPY config.json /config.json
+
+ENV JSON_CONFIG_PATH=/config.json

dev/mockoauth/config.json

@@ -0,0 +1,55 @@
+{
+  "interactiveLogin": true,
+  "tokenCallbacks": [
+    {
+      "issuerId": "scopa",
+      "tokenExpiry": 3600,
+      "requestMappings": [
+        {
+          "requestParam": "subject",
+          "match": "alice",
+          "claims": {
+            "sub": "alice",
+            "preferred_username": "alice",
+            "name": "Alice"
+          }
+        },
+        {
+          "requestParam": "subject",
+          "match": "bob",
+          "claims": {
+            "sub": "bob",
+            "preferred_username": "bob",
+            "name": "Bob"
+          }
+        },
+        {
+          "requestParam": "subject",
+          "match": "carol",
+          "claims": {
+            "sub": "carol",
+            "preferred_username": "carol",
+            "name": "Carol"
+          }
+        },
+        {
+          "requestParam": "subject",
+          "match": "dave",
+          "claims": {
+            "sub": "dave",
+            "preferred_username": "dave",
+            "name": "Dave"
+          }
+        },
+        {
+          "requestParam": "subject",
+          "match": ".*",
+          "claims": {
+            "sub": "${subject}",
+            "preferred_username": "${subject}"
+          }
+        }
+      ]
+    }
+  ]
+}