MT is really, really bad. We don't see it too much in the real world, but it's so easy to attack that we have several attacks on it in our crypto challenges.
seed = SHA256(client_seed + server_seed) % 2 ^ 32
I _think_ to attack this you would need to do two seemingly difficult things. 1) come up with a seed which generates a sequence from the prng which allows a shuffle to create a favourable-to-you deck - this might be doable given my very quick reading of MT's weaknesses. But then you need to do 2) create a server_seed such that PRNGseed = SHA256(client_seed + server_seed) % 2 ^ 32. I suspect that's "hard". (I don't know if SHA256 is vulnerable to extension attacks the way MD5 is - I don't _thin_ so, but even if it were, some simple "plausibility checks" on the alleged server_seed would protect against that.)
I guess there's a problem if the client_seed ad server_seed ever get re-used - but that's a common crypto in-use issure, right? Just don't do that...
I still think this works though. Unless there is a way for them to chose a server_seed such that:
SHA256(server_seed + client_seed) % 2 ^ 32 = PRNG_seed(favourable to them)
without my choice of client_seed messing up their desired PRNG_seed.
They note they're actually reshuffling, not just cutting the deck, but even then there are only 2^32 possible seeds and thus 2^32 possible reshuffles. What's stopping them from pregenerating server seeds that are biased in their favor? Maybe using MT makes that even easier.