ci(web): build wasm in the deploy pipeline instead of committing it (#156)

The wasm bundles in solitaire_server/web/pkg/ are no longer tracked. The
web-wasm-rebuild workflow (which rebuilt them in CI and committed them
back to master) is gone; instead:

- solitaire_server/Dockerfile gains a wasm-builder stage that runs
  build_wasm.sh with the same pinned toolchain (wasm-bindgen 0.2.120,
  wasm-pack 0.14.0, binaryen 130) and the runtime image copies pkg/
  from it — the image build is now the artifacts' single source of truth.
- web-e2e builds the wasm before Playwright runs, and its trigger paths
  now include the wasm-feeding crates it actually tests.
- docker-build triggers on solitaire_data/** and build_wasm.sh too, so
  every wasm-affecting change redeploys.
- Self-hosters serving /web or /play from a source checkout run
  ./build_wasm.sh once (script header and ARCHITECTURE.md updated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/docker-build.yml

@@ -10,9 +10,11 @@ on:
       - 'solitaire_web/**'
       - 'solitaire_sync/**'
       - 'solitaire_core/**'
+      - 'solitaire_data/**'
       - 'solitaire_engine/**'
       - 'Cargo.toml'
       - 'Cargo.lock'
+      - 'build_wasm.sh'
       - 'solitaire_server/Dockerfile'
       - '.gitea/workflows/docker-build.yml'
 
@@ -36,12 +38,9 @@ jobs:
         id: meta
         run: echo "sha=${GITHUB_SHA::8}" >> "$GITHUB_OUTPUT"
 
-      # WASM artifact freshness is owned by the `web-wasm-rebuild` workflow,
-      # which rebuilds pkg/ in CI on every master change to a wasm-feeding crate
-      # and commits it back (CI is the single source of truth — the artifacts
-      # aren't byte-reproducible on contributor machines). That pkg/ commit then
-      # triggers this workflow, so the deployed image always ships fresh wasm.
-      # No drift check is needed here.
+      # The wasm bundles (solitaire_server/web/pkg/) are not in the repo —
+      # the Dockerfile's wasm-builder stage builds them from source inside
+      # this image build, so the deployed image always ships fresh wasm.
 
       - name: Log in to Gitea registry
         uses: docker/login-action@v3