docs: add CREDITS.md and link from README

Lists the project's third-party assets and major dependencies with
their licenses for v1 release readiness:
- xCards @2x card artwork and back_0 (LGPL-3.0)
- FiraMono-Medium font (OFL)
- Bevy 0.18, kira 0.12, axum, sqlx, tokio, and the rest of the
  ten most prominent Rust deps (MIT/Apache-2.0 across the board)

Generated assets — card backs 1-4, all backgrounds, and every WAV
file — are credited as original work produced by the project's own
solitaire_assetgen pipeline; the audio synthesis stack and the
absence of any external sample sources are documented.

The README gains a brief Credits section linking to the full list.

Note: the upstream xCards source URL is left as a placeholder pending
confirmation; downstream license obligations are unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -68,6 +68,14 @@ cargo test -p solitaire_core -p solitaire_sync -p solitaire_data -p solitaire_se
 cargo clippy --workspace -- -D warnings
 ```
 
+## Credits
+
+Built on [Bevy](https://bevyengine.org/) and the wider Rust ecosystem (Tokio,
+Axum, sqlx, Serde, kira, and many more). Card faces and the default card back
+use xCards artwork (LGPL-3.0); the UI font is FiraMono-Medium (OFL). All audio
+is synthesized programmatically by this project. See [CREDITS.md](CREDITS.md)
+for the full list and license details.
+
 ## License
 
 MIT — see [LICENSE](LICENSE).