ci(web): build wasm in the deploy pipeline instead of committing it (#156)

The wasm bundles in solitaire_server/web/pkg/ are no longer tracked. The
web-wasm-rebuild workflow (which rebuilt them in CI and committed them
back to master) is gone; instead:

- solitaire_server/Dockerfile gains a wasm-builder stage that runs
  build_wasm.sh with the same pinned toolchain (wasm-bindgen 0.2.120,
  wasm-pack 0.14.0, binaryen 130) and the runtime image copies pkg/
  from it — the image build is now the artifacts' single source of truth.
- web-e2e builds the wasm before Playwright runs, and its trigger paths
  now include the wasm-feeding crates it actually tests.
- docker-build triggers on solitaire_data/** and build_wasm.sh too, so
  every wasm-affecting change redeploys.
- Self-hosters serving /web or /play from a source checkout run
  ./build_wasm.sh once (script header and ARCHITECTURE.md updated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

solitaire_server/Dockerfile

@@ -1,3 +1,68 @@
+# --- WASM build stage ---
+# Builds solitaire_server/web/pkg/ (replay viewer + Bevy canvas app) from
+# source. The artifacts are not committed to the repo (issue #156); this
+# stage is their single source of truth for deployment.
+FROM rust:1.95-slim AS wasm-builder
+
+WORKDIR /build
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN rustup target add wasm32-unknown-unknown
+
+# Pinned wasm toolchain — keep versions in sync with
+# .gitea/workflows/web-e2e.yml and build_wasm.sh prerequisites.
+RUN curl -sSL https://github.com/rustwasm/wasm-bindgen/releases/download/0.2.120/wasm-bindgen-0.2.120-x86_64-unknown-linux-musl.tar.gz \
+      | tar xz -C /opt \
+    && ln -s /opt/wasm-bindgen-0.2.120-x86_64-unknown-linux-musl/wasm-bindgen /usr/local/bin/wasm-bindgen \
+    && curl -sSL https://github.com/rustwasm/wasm-pack/releases/download/v0.14.0/wasm-pack-v0.14.0-x86_64-unknown-linux-musl.tar.gz \
+      | tar xz -C /opt \
+    && ln -s /opt/wasm-pack-v0.14.0-x86_64-unknown-linux-musl/wasm-pack /usr/local/bin/wasm-pack \
+    && curl -sSL https://github.com/WebAssembly/binaryen/releases/download/version_130/binaryen-version_130-x86_64-linux.tar.gz \
+      | tar xz -C /opt \
+    && ln -s /opt/binaryen-version_130/bin/wasm-opt /usr/local/bin/wasm-opt
+
+# Manifests first so the dependency-fetch layer caches across source changes
+# (same pattern as the server build stage below).
+COPY .cargo/config.toml            ./.cargo/config.toml
+COPY Cargo.toml Cargo.lock ./
+COPY solitaire_core/Cargo.toml     ./solitaire_core/Cargo.toml
+COPY solitaire_sync/Cargo.toml     ./solitaire_sync/Cargo.toml
+COPY solitaire_data/Cargo.toml     ./solitaire_data/Cargo.toml
+COPY solitaire_engine/Cargo.toml   ./solitaire_engine/Cargo.toml
+COPY solitaire_server/Cargo.toml   ./solitaire_server/Cargo.toml
+COPY solitaire_app/Cargo.toml      ./solitaire_app/Cargo.toml
+COPY solitaire_assetgen/Cargo.toml ./solitaire_assetgen/Cargo.toml
+COPY solitaire_wasm/Cargo.toml     ./solitaire_wasm/Cargo.toml
+COPY solitaire_web/Cargo.toml      ./solitaire_web/Cargo.toml
+
+RUN for crate in solitaire_core solitaire_sync solitaire_data solitaire_engine \
+        solitaire_server solitaire_app solitaire_assetgen solitaire_wasm solitaire_web; do \
+      mkdir -p $crate/src && echo "pub fn _stub() {}" > $crate/src/lib.rs; \
+    done && \
+    echo "fn main() {}" > solitaire_server/src/main.rs && \
+    echo "fn main() {}" > solitaire_app/src/main.rs && \
+    echo "fn main() {}" > solitaire_assetgen/src/main.rs
+
+RUN cargo fetch --locked
+
+# Real source for the wasm-feeding crates. Whole crate directories (not just
+# src/) because solitaire_engine embeds theme/audio/font assets at compile
+# time from its own assets/ and the workspace assets/.
+COPY build_wasm.sh ./
+COPY solitaire_core   ./solitaire_core
+COPY solitaire_sync   ./solitaire_sync
+COPY solitaire_data   ./solitaire_data
+COPY solitaire_engine ./solitaire_engine
+COPY solitaire_wasm   ./solitaire_wasm
+COPY solitaire_web    ./solitaire_web
+COPY assets           ./assets
+
+RUN ./build_wasm.sh
+
 # --- Build stage ---
 FROM rust:1.95-slim AS builder
 
@@ -67,6 +132,8 @@ COPY --from=builder /build/target/release/solitaire_server ./server
 #   /app/assets                →  /assets route
 # Card themes (dark + classic) are embedded in the binary; no theme files needed here.
 COPY solitaire_server/web ./solitaire_server/web
+# The wasm bundles are never in the repo — they come from the wasm-builder stage.
+COPY --from=wasm-builder /build/solitaire_server/web/pkg ./solitaire_server/web/pkg
 COPY assets ./assets
 
 ENV SERVER_PORT=8080