Initial build: fullhouse, live music bingo from a real Spotify playlist

Based on bingo-bango by f8al (MIT) — same core card-generation idea
("both facets": a square is either an exact song title or an artist,
and an artist square lights up on any of their tracks), reworked with
a real host/guest split, live multiplayer sessions, and cover-art
squares. f8al credited in the footer, README, and PROPOSAL.md.

Three ways to play: host a live session (server-side Spotify
connection, join code + QR, caller screen, auto-call from real
playback), join someone else's session (no login needed), or solo
(guest PKCE login or a pasted public playlist URL, one-off card).

Genuinely verified against a real Spotify account throughout, not
just built and assumed working — including two real bugs found and
fixed along the way (Spotify's playlist-tracks endpoint quietly
renamed to /items with a reshaped response; reading playlist tracks
needs real user auth even for public playlists, so the "no guest
login" public-playlist path routes through the host's connection
instead of a dead-end app-only token). Both Docker images built and
run together on a real network with the nginx proxy verified working
end-to-end, and auto-call confirmed detecting an actual track playing
live through Spotify Connect within one poll tick.

docker-compose.yml

@@ -0,0 +1,29 @@
+services:
+  web:
+    image: ${IMAGE}
+    container_name: fullhouse-web
+    restart: unless-stopped
+    pull_policy: always
+    ports:
+      - "${HOST_PORT:-3080}:80"
+    depends_on:
+      - api
+
+  api:
+    image: ${IMAGE}-api
+    container_name: fullhouse-api
+    restart: unless-stopped
+    pull_policy: always
+    environment:
+      PORT: 3010
+      SPOTIFY_CLIENT_ID: ${SPOTIFY_CLIENT_ID}
+      SPOTIFY_CLIENT_SECRET: ${SPOTIFY_CLIENT_SECRET}
+      SPOTIFY_HOST_REDIRECT_URI: ${SPOTIFY_HOST_REDIRECT_URI}
+    volumes:
+      # Named volume — holds the host's Spotify refresh token. Without
+      # it, every redeploy wipes the host connection and the one-time
+      # OAuth consent has to be redone.
+      - fullhouse-api-data:/app/data
+
+volumes:
+  fullhouse-api-data: