ci(web): build wasm in the deploy pipeline instead of committing it (#156)

The wasm bundles in solitaire_server/web/pkg/ are no longer tracked. The
web-wasm-rebuild workflow (which rebuilt them in CI and committed them
back to master) is gone; instead:

- solitaire_server/Dockerfile gains a wasm-builder stage that runs
  build_wasm.sh with the same pinned toolchain (wasm-bindgen 0.2.120,
  wasm-pack 0.14.0, binaryen 130) and the runtime image copies pkg/
  from it — the image build is now the artifacts' single source of truth.
- web-e2e builds the wasm before Playwright runs, and its trigger paths
  now include the wasm-feeding crates it actually tests.
- docker-build triggers on solitaire_data/** and build_wasm.sh too, so
  every wasm-affecting change redeploys.
- Self-hosters serving /web or /play from a source checkout run
  ./build_wasm.sh once (script header and ARCHITECTURE.md updated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -41,3 +41,7 @@ deploy/*-auth-secret.yaml
 # Local token-saving helper scripts (peek/cargoclip/testfail/diffclip/etc.) —
 # inspection-only Go tools, not committed. Tracked scripts/*.sh and *.md stay.
 scripts/*.go
+
+# WASM bundles — built by build_wasm.sh locally and by the Docker wasm-builder
+# stage / web-e2e workflow in CI; never committed (issue #156)
+solitaire_server/web/pkg/