Prod hardening: one-game-per-player, selectable music, bargevasat.ir config

- One running game per player: server rejects a 2nd matchmake while in a live
  room (re-syncs the existing game); client guards Home vs-computer + Lobby
  random/create — resumes the running match + notifies instead of starting another
  (game-store hasActiveMatch()).
- Background music is now selectable: santoor (سنتی, calm Persian loop) and
  playful (bouncy UNO-like) — sound.ts TRACKS + setMusicTrack (persisted),
  sound-store musicTrack, picker in Profile → Audio. i18n added.
- Production config for bargevasat.ir (prepare-only; no live deploy):
  appsettings.Production.example (CORS + ZarinPal + IAB to the domain),
  docker-compose.caddy.yml + Caddyfile (auto-HTTPS reverse proxy
  bargevasat.ir→web, api.bargevasat.ir→server), ENV_FILE PRODUCTION block,
  PRODUCTION.md go-live + Cafe Bazaar publish/IAB checklist. Fixed IAB package
  name to match Capacitor appId (com.bargevasat.app).

Verified: tsc + next build + dotnet build all pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/Hokm.Server/Game/GameManager.cs

@@ -47,6 +47,14 @@ public sealed class GameManager
 
     public void StartMatchmaking(Player p)
     {
+        // One running game per player: if already in a live match, re-sync them to
+        // it (re-broadcasts current state) instead of starting a second game.
+        if (RoomOf(p.UserId) is { } existing)
+        {
+            existing.SetConnected(p.UserId, true);
+            return;
+        }
+
         // Pro players skip the queue entirely.
         if (p.Plan == "pro")
         {

server/src/Hokm.Server/appsettings.Production.json.example

@@ -1,5 +1,5 @@
 {
-  "// note": "Copy to appsettings.Production.json and fill secrets. Run with ASPNETCORE_ENVIRONMENT=Production.",
+  "// note": "Copy to appsettings.Production.json and fill secrets. Run with ASPNETCORE_ENVIRONMENT=Production. (The Docker deploy uses env vars from ENV_FILE instead — this file is for a bare-metal run.)",
   "Jwt": {
     "Key": "CHANGE-ME-to-a-long-random-secret-32+chars",
     "Issuer": "hokm",
@@ -12,10 +12,27 @@
     "// Supabase": "Project Settings → Database → Connection string (use the pooled 6543 or direct 5432)",
     "Default": "Host=db.<project>.supabase.co;Port=5432;Database=postgres;Username=postgres;Password=<password>;SSL Mode=Require;Trust Server Certificate=true"
   },
+  "Cors": {
+    "Origins": "https://bargevasat.ir,https://www.bargevasat.ir"
+  },
   "Zarinpal": {
     "MerchantId": "<your-live-merchant-id>",
     "Sandbox": false,
-    "CallbackUrl": "https://api.yourdomain.com/api/coins/pay/callback",
-    "ClientReturnUrl": "https://yourdomain.com"
+    "CallbackUrl": "https://api.bargevasat.ir/api/coins/pay/callback",
+    "ClientReturnUrl": "https://bargevasat.ir"
+  },
+  "Iab": {
+    "// note": "Cafe Bazaar / Myket in-app purchase. Fill after publishing & getting store creds.",
+    "AllowUnverified": false,
+    "Bazaar": {
+      "PackageName": "com.bargevasat.app",
+      "ClientId": "<bazaar-client-id>",
+      "ClientSecret": "<bazaar-client-secret>",
+      "RefreshToken": "<bazaar-refresh-token>"
+    },
+    "Myket": {
+      "PackageName": "com.bargevasat.app",
+      "AccessToken": "<myket-access-token>"
+    }
   }
 }