Prod hardening: one-game-per-player, selectable music, bargevasat.ir config

- One running game per player: server rejects a 2nd matchmake while in a live
  room (re-syncs the existing game); client guards Home vs-computer + Lobby
  random/create — resumes the running match + notifies instead of starting another
  (game-store hasActiveMatch()).
- Background music is now selectable: santoor (سنتی, calm Persian loop) and
  playful (bouncy UNO-like) — sound.ts TRACKS + setMusicTrack (persisted),
  sound-store musicTrack, picker in Profile → Audio. i18n added.
- Production config for bargevasat.ir (prepare-only; no live deploy):
  appsettings.Production.example (CORS + ZarinPal + IAB to the domain),
  docker-compose.caddy.yml + Caddyfile (auto-HTTPS reverse proxy
  bargevasat.ir→web, api.bargevasat.ir→server), ENV_FILE PRODUCTION block,
  PRODUCTION.md go-live + Cafe Bazaar publish/IAB checklist. Fixed IAB package
  name to match Capacitor appId (com.bargevasat.app).

Verified: tsc + next build + dotnet build all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.caddy.yml

@@ -0,0 +1,27 @@
+# Production HTTPS overlay for bargevasat.ir.
+# Caddy terminates TLS (auto Let's Encrypt) and reverse-proxies:
+#   https://bargevasat.ir       → web   (nginx static)
+#   https://api.bargevasat.ir   → server (.NET SignalR)
+# Run:  docker compose -f docker-compose.yml -f docker-compose.caddy.yml up -d
+# (web/server are reached over the compose network by name; their host port
+#  publishes from docker-compose.yml are harmless but optional in prod.)
+
+services:
+  caddy:
+    image: mirror.soroushasadi.com/caddy:2-alpine
+    container_name: hokm-caddy
+    restart: unless-stopped
+    depends_on:
+      - web
+      - server
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - hokm_caddy_data:/data
+      - hokm_caddy_config:/config
+
+volumes:
+  hokm_caddy_data:
+  hokm_caddy_config: