games: the card the dealer never turned over, and the bet that came back doubled

Bust every hand and the dealer doesn't draw, which is right, but it was also
not turning over: reveal is only emitted by dealerPlay, and busting out skips
the dealer entirely. The browser kept the hole card face down while the settled
state printed the dealer's whole total under it. Emit the reveal on that path.

And standing your bet back up after a reload read the hand's bet straight off
the settled state, which a double has already doubled. Reload, double 200, and
the next hand starts with 400 on the spot.

Plus: the share card was hand-writing a Content-Length that ServeContent
overwrites anyway, and serving a zero-byte 200 for a room with no card.

Claude-Session: https://claude.ai/code/session_013M5nD7PgUboJXoDcYHzpuJ

internal/web/games_pages.go

@@ -173,10 +173,12 @@ func (s *Server) casinoURL(r *http.Request, route string) string {
 
 func (s *Server) gamesPage(r *http.Request) gamesPage {
 	return gamesPage{
-		Room:          roomAt(time.Now().Hour()),
-		URL:           s.casinoURL(r, r.URL.Path),
-		OGImage:       s.casinoURL(r, "/games/og.png"),
-		User:          s.auth.userFromRequest(r), // requirePlayer ran first, so this is non-nil
+		Room:    roomAt(time.Now().Hour()),
+		URL:     s.casinoURL(r, r.URL.Path),
+		OGImage: s.casinoURL(r, "/games/og.png"),
+		// Nil on the front door, and only there — every other page ran requirePlayer
+		// first. A template that reads .User has to guard it.
+		User:          s.auth.userFromRequest(r),
 		Cap:           storage.MaxChipsOnTable,
 		RakePct:       int(blackjack.DefaultRules().RakePct * 100),
 		Soon:          comingSoon,