castle: host the card game on the games hub

[aaylward]

Castle (the shedding game also played as Palace) as the second game on the games hub, on the room/session layer #79 describes and #1187 built for golf. The golf migration is the template: engine in libs/cards, game vocabulary as one member per streaming union, per-viewer redaction in the hub, UI over the smithy wire.

Rules

The engine plays them as stated on GameState in libs/cards/castle/game_state.h and pinned in its tests: 2–4 players, one deck, three face-down / three face-up / three in hand; setup swaps then ready; lowest ordinary hand card opens; equal-or-higher plays, twos reset, tens and four of a kind burn (the burner goes again unless the burn shed their last card); must play if able, otherwise pick up the pile; face-up row then blind face-down row once the hand is gone; first out wins, last holder loses; a leaver never names a loser. No sevens-or-lower or eights-skip variants.

Phases

1. Engine — libs/cards/castle: immutable Player/GameState value types, dealCastleGame, finish order, abandonment. cards: the castle rules engine #1484.
2. Model — castle member beside golf in the hub's GolfCommands/GolfMove/GolfEvents/GolfUpdate unions (or the game-agnostic renames that step implies), a Play stream at /games/v2/castle/play, and the per-viewer view: own hand and everyone's face-up rows visible, face-down rows as counts, pile top and draw-pile count, whose turn, finish order. Redaction stays in the hub's ViewLocked, as for golf.
3. Hub — the castle handler on the shared session/room layer: setup swaps and ready, the four move kinds (play from hand, play face-up, flip face-down, pick up), leave/abandon, in-band rejections; the in-memory e2e suite plays a scripted game to the end with NoShuffleDealer.
4. Persistence — versioned serde of the castle GameState into the games table, restore at boot (the golf shape from golf_hub persistence: restart survival now, horizontal scaling later #1194).
5. UI — muchq.github.io: a castle app over the same session mint and event-stream adapter as golf; rooms and chat come for free.
6. Deploy — Caddy route for /games/v2/castle/*, hub metrics, the same ALLOWED_ORIGINS.

Open question for phase 2: whether the golf-named unions become game-agnostic (GameCommands with golf/castle members) in this step or stay as they are with castle nested alongside. #79 argued for one member per union per game; the rename is cosmetic on the wire but touches every golf client.