ui/phase-25: backend turn-cutoff guard + auto-pause + UI sync protocol

Backend now owns the turn-cutoff and pause guards the order tab
relies on: the scheduler flips runtime_status between
generation_in_progress and running around every engine tick, a
failed tick auto-pauses the game through OnRuntimeSnapshot, and a
new game.paused notification kind fans out alongside
game.turn.ready. The user-games handlers reject submits with
HTTP 409 turn_already_closed or game_paused depending on the
runtime state.

UI delegates auto-sync to a new OrderQueue: offline detection,
single retry on reconnect, conflict / paused classification.
OrderDraftStore surfaces conflictBanner / pausedBanner runes,
clears them on local mutation or on a game.turn.ready push via
resetForNewTurn. The order tab renders the matching banners and
the new conflict per-row badge; i18n bundles cover en + ru.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -785,9 +785,21 @@ Future scale-out hooks (not in MVP):
 - **runtime snapshot** — engine-status read materialised into the lobby's
   denormalised view: `current_turn`, `runtime_status`,
   `engine_health_summary`, `player_turn_stats`.
-- **turn cutoff** — the `running → generation_in_progress` CAS transition
-  that closes the command window. Commands arriving after the CAS are
-  rejected.
+- **turn cutoff** — the `running → generation_in_progress` runtime-status
+  flip performed by `backend/internal/runtime/scheduler.go` before each
+  engine `/admin/turn` call. Commands and orders arriving while the
+  flag is set are rejected by the user-games handlers with HTTP 409
+  `turn_already_closed`. The matching reopening flip
+  (`generation_in_progress → running`) happens on a successful tick;
+  a failing tick instead drives the lobby to `paused` and fans out
+  `game.paused` (FUNCTIONAL.md §6.3, §6.5).
+- **auto-pause** — the lobby reaction to a failed runtime snapshot
+  (`engine_unreachable` / `generation_failed`): the game flips
+  `running → paused`, the order handlers refuse new submits with
+  HTTP 409 `game_paused`, and `lobby.publishGamePaused` fans out the
+  push event. Only an admin `/resume` followed by a successful tick
+  recovers the game; the UI relies on the next `game.turn.ready` to
+  clear the paused banner.
 - **outbox** — the durable queue of pending mail rows in
   `mail_deliveries`, drained by the mail worker.
 - **freshness window** — the symmetric ±5-minute interval around server