local-dev: rebuild dead sandbox + harden lobby card UX

Three fixes around the dev sandbox end-to-end path. Each one was
flushed out by an actual login walkthrough after the previous
commit.

Backend bootstrap now treats `cancelled`, `finished`, and
`start_failed` as terminal: the per-boot find-or-create skips such
games and provisions a fresh one. Without this, a single bad
shutdown cascade leaves the developer staring at a dead lobby tile
forever (cancelled games don't transition back). Covered by
TestTerminalSandboxStatus.

Tools/local-dev: stop killing engine containers in `make down`. The
runtime treats the disappearance of an engine as a real failure
(cascading the lobby game to `cancelled`); leaving the container
running across `down/up` lets the runtime reconciler re-attach on
the next boot. The teardown happens only in `make clean`, where the
DB is wiped anyway. Compose now also exposes :9090 (authenticated
EdgeGateway listener) on the host so the Vite dev proxy can reach
the Connect-Web surface, and bumps the gateway anti-abuse limits
for `public_misc` so the same surface is not blanket-rejected with
413.

Ui/frontend: the lobby's `My Games` cards are now clickable only
for the playable statuses (`running`, `paused`, `finished`). All
other statuses render as disabled buttons so a click on a draft or
cancelled game no longer drops the user on a 404 — the in-game
view at /games/:id/* doesn't exist before Phase 10 and never makes
sense for a cancelled game. Vite proxy splits the dev targets so
`/api/*` continues to talk to the REST listener and
`/galaxy.gateway.v1.EdgeGateway/*` is routed to the Connect-Web
listener via VITE_DEV_GRPC_PROXY_TARGET (defaults to :9090).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/frontend/src/routes/lobby/+page.svelte

@@ -185,6 +185,16 @@
 		goto(`/games/${gameId}/map`);
 	}
 
+	// Statuses for which the game has a navigable in-game view.
+	// Lobby-internal statuses (draft, enrollment_open, ready_to_start,
+	// starting, start_failed) and terminal ones (cancelled) stay
+	// non-clickable; clicking them otherwise lands on a 404 because
+	// /games/:id/map only meaningfully exists once the runtime has
+	// produced game state.
+	function isPlayableStatus(status: string): boolean {
+		return status === "running" || status === "paused" || status === "finished";
+	}
+
 	onMount(async () => {
 		if (
 			session.keypair === null ||
@@ -259,6 +269,7 @@
 						<button
 							class="card"
 							onclick={() => gotoGame(game.gameId)}
+							disabled={!isPlayableStatus(game.status)}
 							data-testid="lobby-my-game-card"
 						>
 							<strong>{game.gameName}</strong>
@@ -448,6 +459,12 @@
 		width: 100%;
 	}
 
+	button.card:disabled {
+		cursor: not-allowed;
+		color: #777;
+		background: #f0f0f0;
+	}
+
 	li.card {
 		cursor: default;
 	}

ui/frontend/tests/lobby-page.test.ts

@@ -339,6 +339,41 @@ describe("lobby page", () => {
 		});
 	});
 
+	test("my-game cards are clickable for running/paused/finished and disabled otherwise", async () => {
+		// Cover the live-able statuses (running, paused, finished) and a
+		// representative non-playable mix (cancelled is the post-shutdown
+		// terminal state developers see most often; draft is the lobby-
+		// internal state before any membership exists).
+		listMyGamesSpy.mockResolvedValue([
+			makeGame("g-running", "Live", "running"),
+			makeGame("g-paused", "Paused Run", "paused"),
+			makeGame("g-finished", "Closed Run", "finished"),
+			makeGame("g-cancelled", "Cancelled Run", "cancelled"),
+			makeGame("g-draft", "Draft Run", "draft"),
+		]);
+		listPublicGamesSpy.mockResolvedValue({ items: [], page: 1, pageSize: 50, total: 0 });
+		listMyInvitesSpy.mockResolvedValue([]);
+		listMyApplicationsSpy.mockResolvedValue([]);
+
+		const Page = (await importLobbyPage()).default;
+		const ui = render(Page);
+
+		await waitFor(() => {
+			expect(ui.getAllByTestId("lobby-my-game-card").length).toBe(5);
+		});
+		const cards = ui.getAllByTestId("lobby-my-game-card");
+		const disabledByLabel: Record<string, boolean> = {};
+		for (const card of cards) {
+			const label = card.querySelector("strong")?.textContent ?? "";
+			disabledByLabel[label] = (card as HTMLButtonElement).disabled;
+		}
+		expect(disabledByLabel["Live"]).toBe(false);
+		expect(disabledByLabel["Paused Run"]).toBe(false);
+		expect(disabledByLabel["Closed Run"]).toBe(false);
+		expect(disabledByLabel["Cancelled Run"]).toBe(true);
+		expect(disabledByLabel["Draft Run"]).toBe(true);
+	});
+
 	test("application status badges localise pending and approved states", async () => {
 		listMyGamesSpy.mockResolvedValue([]);
 		listPublicGamesSpy.mockResolvedValue({ items: [], page: 1, pageSize: 50, total: 0 });

ui/frontend/vite.config.ts

@@ -10,11 +10,18 @@ const pkg = JSON.parse(
 	),
 ) as { version: string };
 
-// Default upstream gateway address used by the dev proxy. Override by
-// pointing `VITE_DEV_PROXY_TARGET` at a different gateway when working
-// with a remote stack instead of `tools/local-dev/`.
+// Default upstream gateway addresses used by the dev proxy. Override
+// by pointing `VITE_DEV_PROXY_TARGET` (REST surface) and
+// `VITE_DEV_GRPC_PROXY_TARGET` (Connect-Web surface) at a different
+// gateway when working with a remote stack instead of
+// `tools/local-dev/`. In production the two surfaces sit behind a
+// single host; the split here exists only because local-dev runs the
+// REST listener on :8080 and the authenticated Connect-Web listener
+// on :9090.
 const DEV_PROXY_TARGET =
 	process.env.VITE_DEV_PROXY_TARGET ?? "http://localhost:8080";
+const DEV_GRPC_PROXY_TARGET =
+	process.env.VITE_DEV_GRPC_PROXY_TARGET ?? "http://localhost:9090";
 
 export default defineConfig({
 	plugins: [sveltekit()],
@@ -33,7 +40,7 @@ export default defineConfig({
 				changeOrigin: false,
 			},
 			"/galaxy.gateway.v1.EdgeGateway": {
-				target: DEV_PROXY_TARGET,
+				target: DEV_GRPC_PROXY_TARGET,
 				changeOrigin: false,
 				// Connect-Web server-streaming (`SubscribeEvents`) uses
 				// chunked HTTP responses; http-proxy passes them through