feat: reads/players API + REST route conformance test

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G796GsLCvJQKVN7hwV2cDx

lyra/web/server.py

@@ -189,6 +189,26 @@ def create_app() -> FastAPI:
         ok = await asyncio.to_thread(poker.delete_entry, "hand", hand_id)
         return {"ok": ok}
 
+    @app.post("/session/read")
+    async def session_add_read(request: Request) -> dict:
+        """Log a read directly (no LLM); upserts the villain file when name is given."""
+        body = await request.json()
+        rid = await asyncio.to_thread(lambda: poker.add_read(
+            note=body.get("note") or "", seat=body.get("seat"), name=body.get("name"),
+            tendencies=body.get("tendencies"), adjustment=body.get("adjustment"),
+            description=body.get("description"), category=body.get("category"),
+            venue=body.get("venue"),
+        ))
+        return {"ok": True, "id": rid}
+
+    @app.patch("/player/{player_id}")
+    async def player_update(player_id: int, request: Request) -> dict:
+        """Edit a player's dossier (rename, fix tendencies)."""
+        body = await request.json()
+        p = await asyncio.to_thread(lambda: poker.update_player(player_id, **body))
+        logbus.log("info", "player edited", id=player_id, fields=list(body))
+        return {"ok": p is not None, "player": p}
+
     @app.delete("/session/entry/{kind}/{entry_id}")
     async def delete_entry(kind: str, entry_id: int) -> dict:
         """Delete one HUD entry (hand | stack | read | ritual) by id."""