Prod hardening: one-game-per-player, selectable music, bargevasat.ir config

- One running game per player: server rejects a 2nd matchmake while in a live
  room (re-syncs the existing game); client guards Home vs-computer + Lobby
  random/create — resumes the running match + notifies instead of starting another
  (game-store hasActiveMatch()).
- Background music is now selectable: santoor (سنتی, calm Persian loop) and
  playful (bouncy UNO-like) — sound.ts TRACKS + setMusicTrack (persisted),
  sound-store musicTrack, picker in Profile → Audio. i18n added.
- Production config for bargevasat.ir (prepare-only; no live deploy):
  appsettings.Production.example (CORS + ZarinPal + IAB to the domain),
  docker-compose.caddy.yml + Caddyfile (auto-HTTPS reverse proxy
  bargevasat.ir→web, api.bargevasat.ir→server), ENV_FILE PRODUCTION block,
  PRODUCTION.md go-live + Cafe Bazaar publish/IAB checklist. Fixed IAB package
  name to match Capacitor appId (com.bargevasat.app).

Verified: tsc + next build + dotnet build all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/ENV_FILE.example

@@ -44,7 +44,7 @@ ZARINPAL_CLIENT_RETURN_URL=http://localhost:1500
 # Store in-app billing (Cafe Bazaar / Myket) — fill from the developer panels.
 # SKU == coin-pack id (p1/p2/…). Coins are credited only after the purchase
 # token verifies server-to-server.
-IAB_PACKAGE_NAME=com.bargevasat.hokm
+IAB_PACKAGE_NAME=com.bargevasat.app
 # Cafe Bazaar (pardakht dev API): create an OAuth client, do the one-time consent
 # to obtain a refresh_token. https://pardakht.cafebazaar.ir/
 IAB_BAZAAR_CLIENT_ID=
@@ -55,3 +55,21 @@ IAB_MYKET_ACCESS_TOKEN=
 # DEV ONLY: credit purchases WITHOUT verifying (set true to test before you have
 # store creds). NEVER true in production.
 IAB_ALLOW_UNVERIFIED=false
+
+# ──────────────────────────────────────────────────────────────────────────
+# PRODUCTION (bargevasat.ir) — use these values instead of the local ones above,
+# and deploy with the Caddy overlay (see PRODUCTION.md). DNS: bargevasat.ir,
+# www, api → server IP; open 80/443. Caddy fronts TLS, so host ports are internal.
+# ──────────────────────────────────────────────────────────────────────────
+# WEB_PORT=1500
+# API_PORT=1505
+# DB_PORT=1510
+# POSTGRES_PASSWORD=<strong>
+# JWT_KEY=<openssl rand -hex 32>
+# NEXT_PUBLIC_SERVER_URL=https://api.bargevasat.ir   # baked at web build time
+# CORS_ORIGINS=https://bargevasat.ir,https://www.bargevasat.ir
+# ZARINPAL_MERCHANT_ID=<live-merchant-id>
+# ZARINPAL_SANDBOX=false
+# ZARINPAL_CALLBACK_URL=https://api.bargevasat.ir/api/coins/pay/callback
+# ZARINPAL_CLIENT_RETURN_URL=https://bargevasat.ir
+# IAB_ALLOW_UNVERIFIED=false   # fill the IAB_* creds from the Bazaar panel post-publish