feat: /players browser + identity review queue UI

Phase 4. A Players page that browses the whole villain file (named + nameless,
expandable to episodic recall — reads, notable hands, stats, descriptors) and, at
the top, the identity-resolution queue: possible-merges (same/different/dismiss)
and needs-clarification tasks. Rename a nameless villain, set category, or run a
dupe scan inline.

- poker.players_overview() for the list.
- routes: /players (page), /players/data, /player/{id}/data, POST /player/{id}
  (rename/retag), POST /identity/{id}/resolve, POST /players/scan.
- nav: 👤 Players.

Full suite green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lyra/web/server.py

@@ -436,6 +436,45 @@ def create_app() -> FastAPI:
     async def hands_data(limit: int = 60) -> dict:
         return {"hands": poker.list_recent_hands(limit=limit)}
 
+    @app.get("/players")
+    async def players_page() -> FileResponse:
+        """Villain file browser + the identity-resolution review queue."""
+        return FileResponse(str(_STATIC / "players.html"))
+
+    @app.get("/players/data")
+    async def players_data() -> dict:
+        return {"players": poker.players_overview(),
+                "queue": poker.list_identity_queue()}
+
+    @app.get("/player/{player_id}/data")
+    async def player_data(player_id: int) -> dict:
+        return poker.villain_recall(player_id) or {}
+
+    @app.post("/player/{player_id}")
+    async def player_update(player_id: int, request: Request) -> dict:
+        body = await request.json()
+        fields = {k: body[k] for k in ("name", "venue", "category", "tendencies",
+                                       "adjustment", "description") if body.get(k) is not None}
+        if body.get("name"):  # naming via the browser flips it to a real handle
+            poker.name_villain(player_id, body["name"])
+            fields.pop("name", None)
+        row = poker.update_player(player_id, **fields) if fields else None
+        return {"ok": True, "player": row}
+
+    @app.post("/identity/{task_id}/resolve")
+    async def identity_resolve(task_id: int, request: Request) -> dict:
+        body = await request.json()
+        action = body.get("action") or "dismiss"
+        kw = {k: v for k, v in body.items() if k != "action"}
+        ok = await asyncio.to_thread(poker.resolve_identity_task, task_id, action, **kw)
+        logbus.log("info", "identity task resolved", id=task_id, action=action)
+        return {"ok": ok}
+
+    @app.post("/players/scan")
+    async def players_scan() -> dict:
+        filed = await asyncio.to_thread(poker.scan_merge_candidates)
+        return {"ok": True, "filed": filed}
+
     @app.get("/recap/{session_id}")
     async def recap_page() -> FileResponse:
         return FileResponse(str(_STATIC / "recap.html"))