feat(web): add solitaire_web Bevy WASM build targeting play.html canvas

Adds a new `solitaire_web` crate that compiles the full `solitaire_engine`
to `wasm32-unknown-unknown` and renders to a `<canvas id="bevy-canvas">`
element in `play.html` — the same ECS code path as desktop and Android.

Changes to enable the WASM target:
- .cargo/config.toml: add wasm32-unknown-unknown rustflags for getrandom
- Workspace Cargo.toml: add solitaire_web member
- solitaire_data/Cargo.toml: gate tokio/reqwest/dirs/keyring to non-wasm
- solitaire_data/src: add wasm32 branch to data_dir() (returns None);
  cfg-gate sync_client network types, auth_tokens, matomo_client
- solitaire_engine/Cargo.toml: gate tokio/reqwest/kira/arboard/dirs/zip
  to non-wasm (mio/cpal/arboard don't compile for wasm32-unknown-unknown)
- solitaire_engine/src/lib.rs: cfg-gate module declarations and re-exports
  for analytics, audio, sync, sync_setup, avatar, leaderboard plugins
- solitaire_engine/src/core_game_plugin.rs: cfg-gate plugin registrations
  that require TokioRuntime (audio, sync, analytics, leaderboard, avatar)
- solitaire_engine/src/resources.rs: cfg-gate TokioRuntimeResource
- solitaire_engine/src/game_plugin.rs: cfg-gate std::fs::remove_file (x10)
- solitaire_engine/src/theme/mod.rs: cfg-gate importer module (uses dirs+zip)
- solitaire_engine/src/settings_plugin.rs: cfg-gate theme ZIP import UI
- solitaire_engine/src/assets/sources.rs: cfg-gate FileAssetReader/user_theme_dir
- solitaire_engine/src/auto_complete_plugin.rs: cfg-gate audio system
- solitaire_engine/src/daily_challenge_plugin.rs: cfg-gate server fetch
- solitaire_engine/src/hud_plugin.rs: cfg-gate AvatarResource import
- solitaire_engine/src/profile_plugin.rs: cfg-gate AvatarResource import
- solitaire_server/web/play.html: minimal HTML canvas shell
- solitaire_web/: new crate (Cargo.toml + src/lib.rs)
- build_wasm.sh: add Bevy WASM build step (cargo + wasm-bindgen + wasm-opt)

All tests pass; clippy --workspace -- -D warnings clean; native build
(solitaire_engine, solitaire_app) unaffected.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

solitaire_data/Cargo.toml

@@ -12,11 +12,17 @@ serde_json     = { workspace = true }
 chrono         = { workspace = true }
 thiserror      = { workspace = true }
 async-trait    = { workspace = true }
+uuid           = { workspace = true }
+klondike       = { workspace = true }
+
+# These deps are not available / not needed on wasm32:
+#   dirs     — platform data directories (no filesystem on browser)
+#   reqwest  — native HTTP client (sync/analytics gated out on wasm32)
+#   tokio    — OS-threaded async runtime (mio doesn't compile on wasm32)
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 dirs           = { workspace = true }
 reqwest        = { workspace = true }
 tokio          = { workspace = true }
-uuid           = { workspace = true }
-klondike       = { workspace = true }
 
 # `keyring-core` is the typed Entry/Error API used by
 # `auth_tokens`. The crate's own dependency tree pulls in
@@ -25,7 +31,7 @@ klondike       = { workspace = true }
 # on bionic). On Android `auth_tokens` falls back to a stub
 # implementation that always returns `KeychainUnavailable`; the
 # real backend lands when we wire Android Keystore via JNI.
-[target.'cfg(not(target_os = "android"))'.dependencies]
+[target.'cfg(all(not(target_os = "android"), not(target_arch = "wasm32")))'.dependencies]
 keyring-core   = { workspace = true }
 
 [target.'cfg(target_os = "android")'.dependencies]

solitaire_data/src/lib.rs

@@ -146,13 +146,17 @@ pub use settings::{
 #[cfg(target_os = "android")]
 mod android_keystore;
 
+#[cfg(not(target_arch = "wasm32"))]
 pub mod auth_tokens;
+#[cfg(not(target_arch = "wasm32"))]
 pub use auth_tokens::{
     TokenError, delete_tokens, load_access_token, load_refresh_token, store_tokens,
 };
 
 pub mod sync_client;
-pub use sync_client::{LocalOnlyProvider, SolitaireServerClient, provider_for_backend};
+pub use sync_client::LocalOnlyProvider;
+#[cfg(not(target_arch = "wasm32"))]
+pub use sync_client::{SolitaireServerClient, provider_for_backend};
 
 pub mod replay;
 pub use replay::{
@@ -163,7 +167,9 @@ pub use replay::{
 #[allow(deprecated)]
 pub use replay::{latest_replay_path, load_latest_replay_from, save_latest_replay_to};
 
+#[cfg(not(target_arch = "wasm32"))]
 pub mod matomo_client;
+#[cfg(not(target_arch = "wasm32"))]
 pub use matomo_client::MatomoClient;
 
 pub mod platform;

solitaire_data/src/platform.rs

@@ -55,7 +55,15 @@ pub fn data_dir() -> Option<PathBuf> {
     {
         Some(PathBuf::from(ANDROID_APP_FILES_DIR))
     }
-    #[cfg(not(target_os = "android"))]
+    #[cfg(target_arch = "wasm32")]
+    {
+        // No filesystem on the browser; all persistence goes through
+        // WasmStorage (localStorage-backed). Return None so every caller
+        // degrades gracefully (the same path they take on a
+        // misconfigured desktop environment).
+        None
+    }
+    #[cfg(all(not(target_os = "android"), not(target_arch = "wasm32")))]
     {
         dirs::data_dir()
     }

solitaire_data/src/sync_client.rs

@@ -14,8 +14,10 @@
 use async_trait::async_trait;
 use solitaire_sync::{ChallengeGoal, LeaderboardEntry, SyncPayload, SyncResponse};
 
+use crate::{SyncError, SyncProvider};
+
+#[cfg(not(target_arch = "wasm32"))]
 use crate::{
-    SyncError, SyncProvider,
     auth_tokens::{load_access_token, load_refresh_token, store_tokens},
     replay::Replay,
     settings::SyncBackend,
@@ -54,12 +56,17 @@ impl SyncProvider for LocalOnlyProvider {
 // ---------------------------------------------------------------------------
 // SolitaireServerClient
 // ---------------------------------------------------------------------------
+// Native-only: HTTP sync client and factory function.
+// On wasm32 these are gated out because reqwest uses native OS networking
+// (mio + hyper) which does not compile for wasm32-unknown-unknown.
+// ---------------------------------------------------------------------------
 
 /// HTTP sync client for the self-hosted Ferrous Solitaire server.
 ///
 /// Authenticates via JWT stored in the OS keychain. On a 401 response the
 /// client automatically attempts a token refresh and retries the request once
 /// before returning an error.
+#[cfg(not(target_arch = "wasm32"))]
 pub struct SolitaireServerClient {
     /// Base URL of the server, e.g. `"https://solitaire.example.com"`.
     /// Trailing slashes are stripped on construction.
@@ -70,6 +77,7 @@ pub struct SolitaireServerClient {
     client: reqwest::Client,
 }
 
+#[cfg(not(target_arch = "wasm32"))]
 impl SolitaireServerClient {
     /// Construct a new client for the given server URL and username.
     ///
@@ -201,6 +209,7 @@ impl SolitaireServerClient {
     }
 }
 
+#[cfg(not(target_arch = "wasm32"))]
 #[async_trait]
 impl SyncProvider for SolitaireServerClient {
     /// Fetch the latest sync payload from the server.
@@ -486,6 +495,7 @@ impl SyncProvider for SolitaireServerClient {
     }
 }
 
+#[cfg(not(target_arch = "wasm32"))]
 impl SolitaireServerClient {
     /// Pulled out of `push_replay` so both the first attempt and the
     /// post-401-retry attempt go through the same parse path.
@@ -581,9 +591,10 @@ impl SolitaireServerClient {
 }
 
 // ---------------------------------------------------------------------------
-// Response extraction helpers
+// Response extraction helpers (native-only, use reqwest::Response)
 // ---------------------------------------------------------------------------
 
+#[cfg(not(target_arch = "wasm32"))]
 /// Deserialize a pull response body as [`SyncResponse`] and return its
 /// `merged` field, or map non-200 statuses to the appropriate [`SyncError`].
 ///
@@ -607,6 +618,7 @@ async fn extract_pull_body(resp: reqwest::Response) -> Result<SyncPayload, SyncE
     }
 }
 
+#[cfg(not(target_arch = "wasm32"))]
 /// Deserialize a leaderboard response body as `Vec<LeaderboardEntry>`.
 async fn extract_leaderboard_body(
     resp: reqwest::Response,
@@ -621,6 +633,7 @@ async fn extract_leaderboard_body(
     }
 }
 
+#[cfg(not(target_arch = "wasm32"))]
 /// Deserialize a push response body as [`SyncResponse`], or map non-200
 /// statuses to the appropriate [`SyncError`].
 ///
@@ -652,6 +665,7 @@ async fn extract_push_body(resp: reqwest::Response) -> Result<SyncResponse, Sync
 /// This is the **one** place in the codebase that matches on [`SyncBackend`]
 /// variants. All other code receives a `Box<dyn SyncProvider + Send + Sync>`
 /// and remains backend-agnostic.
+#[cfg(not(target_arch = "wasm32"))]
 pub fn provider_for_backend(backend: &SyncBackend) -> Box<dyn SyncProvider + Send + Sync> {
     match backend {
         SyncBackend::Local => Box::new(LocalOnlyProvider),