Initial scopone scientifico backend

Multiplayer scopone scientifico backend on the kaya framework:

- OIDC login (kaya-oidc), session-backed WebSocket auth
- Pure rules engine (forced captures, scopa, primiera scoring) with
  full-match simulation tests
- Live game state in Redis (JSON + TTL, join codes, per-game locks,
  pub/sub state push); in-memory fallback for tests
- WebSocket /ws/games/{id} for real-time play; REST lobby endpoints
  (create/join/snapshot) with hidden-hand views
- Finished matches persisted to Postgres (Tortoise + aerich) for match
  history and leaderboard endpoints
- Docker Compose stack: postgres, redis, mock-oauth2-server, db-migrate, app
- 45 tests passing; mypy clean

docker-compose.yml

@@ -0,0 +1,101 @@
+services:
+  postgres:
+    image: postgres:18-alpine
+    environment:
+      POSTGRES_DB: scopa
+      POSTGRES_USER: scopa
+      POSTGRES_PASSWORD: scopa
+    ports:
+      - "5432:5432"
+    volumes:
+      - pgdata:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U scopa"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  # Mock OIDC provider (navikt/mock-oauth2-server). Zero manual setup:
+  # interactive login accepts any username (no password). Pre-configured
+  # players: alice, bob, carol, dave; any other username works too.
+  # The mock does not validate clients, so any client id/secret works.
+  #
+  # It listens on 8180 both inside and outside the network so the OIDC
+  # issuer URL (http://mockoauth:8180/scopa) is identical for
+  # container-to-container calls and for browser redirects (via the
+  # /etc/hosts entry documented in the README).
+  mockoauth:
+    # Derived image baking dev/mockoauth/config.json in (see
+    # dev/mockoauth/Dockerfile) — a bind mount would not work against
+    # containerized docker daemons.
+    build: ./dev/mockoauth
+    environment:
+      SERVER_PORT: "8180"
+      LOG_LEVEL: INFO
+    ports:
+      - "8180:8180"
+
+  # The JRE image has no usable healthcheck tooling; gate the app on the
+  # discovery endpoint being served instead.
+  mockoauth-init:
+    image: curlimages/curl
+    depends_on:
+      - mockoauth
+    entrypoint: >
+      /bin/sh -c "
+      until curl -sf http://mockoauth:8180/scopa/.well-known/openid-configuration > /dev/null; do
+        echo 'waiting for mockoauth...'; sleep 2;
+      done
+      "
+
+  # Sessions + live game state. No volume: sessions are disposable (worst
+  # case, users log in again) and games in progress have a TTL.
+  redis:
+    image: redis:8-alpine
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  # One-shot: applies pending aerich migrations before the app starts
+  # (build cache makes the second build of the same Dockerfile instant).
+  db-migrate:
+    build: .
+    # aerich reads [tool.aerich] from /app/pyproject.toml (default config
+    # file) and finds migrations in ./migrations relative to working_dir.
+    working_dir: /app
+    command: ["aerich", "upgrade"]
+    environment:
+      DATABASE_URL: postgres://scopa:scopa@postgres:5432/scopa
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  scopa:
+    build: .
+    depends_on:
+      postgres:
+        condition: service_healthy
+      db-migrate:
+        condition: service_completed_successfully
+      mockoauth-init:
+        condition: service_completed_successfully
+      redis:
+        condition: service_healthy
+    environment:
+      DATABASE_URL: postgres://scopa:scopa@postgres:5432/scopa
+      OIDC_ISSUER: http://mockoauth:8180/scopa
+      # The mock OIDC server does not validate clients: any id/secret works.
+      OIDC_CLIENT_ID: scopa
+      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET:-dev-secret}
+      # Browser-facing callback: the app is published on host port 8080.
+      OIDC_REDIRECT_URI: http://localhost:8080/auth/callback
+      REDIS_URL: redis://redis:6379/0
+    ports:
+      - "127.0.0.1:8080:8080"
+
+volumes:
+  pgdata: