ui/phase-24: push events, turn-ready toast, single SubscribeEvents consumer

Wires the gateway's signed SubscribeEvents stream end-to-end:

- backend: emit game.turn.ready from lobby.OnRuntimeSnapshot on every
  current_turn advance, addressed to every active membership, push-only
  channel, idempotency key turn-ready:<game_id>:<turn>;
- ui: single EventStream singleton replaces revocation-watcher.ts and
  carries both per-event dispatch and revocation detection; toast
  primitive (store + host) lives in lib/; GameStateStore gains
  pendingTurn/markPendingTurn/advanceToPending and a persisted
  lastViewedTurn so a return after multiple turns surfaces the same
  "view now" affordance as a live push event;
- mandatory event-signature verification through ui/core
  (verifyPayloadHash + verifyEvent), full-jitter exponential backoff
  1s -> 30s on transient failure, signOut("revoked") on
  Unauthenticated or clean end-of-stream;
- catalog and migration accept the new kind; tests cover producer
  (testcontainers + capturing publisher), consumer (Vitest event
  stream, toast, game-state extensions), and a Playwright e2e
  delivering a signed frame to the live UI.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/frontend/tests/e2e/fixtures/canon.ts

@@ -6,6 +6,7 @@
 // truth; this TS copy stays small enough to read against that test.
 
 const RESPONSE_DOMAIN_MARKER_V1 = "galaxy-response-v1";
+const EVENT_DOMAIN_MARKER_V1 = "galaxy-event-v1";
 
 export interface ResponseSigningFields {
 	protocolVersion: string;
@@ -15,6 +16,15 @@ export interface ResponseSigningFields {
 	payloadHash: Uint8Array;
 }
 
+export interface EventSigningFields {
+	eventType: string;
+	eventId: string;
+	timestampMs: bigint;
+	requestId: string;
+	traceId: string;
+	payloadHash: Uint8Array;
+}
+
 export function buildResponseSigningInput(
 	fields: ResponseSigningFields,
 ): Uint8Array {
@@ -28,6 +38,24 @@ export function buildResponseSigningInput(
 	return new Uint8Array(parts);
 }
 
+// `buildEventSigningInput` mirrors `ui/core/canon/event.go`
+// `BuildEventSigningInput`. The Go-side parity test
+// (`gateway/authn/parity_with_ui_core_test.go`) is the source of truth;
+// this TS copy stays close enough to that test to read against it.
+export function buildEventSigningInput(
+	fields: EventSigningFields,
+): Uint8Array {
+	const parts: number[] = [];
+	appendLengthPrefixedString(parts, EVENT_DOMAIN_MARKER_V1);
+	appendLengthPrefixedString(parts, fields.eventType);
+	appendLengthPrefixedString(parts, fields.eventId);
+	appendBigEndianUint64(parts, fields.timestampMs);
+	appendLengthPrefixedString(parts, fields.requestId);
+	appendLengthPrefixedString(parts, fields.traceId);
+	appendLengthPrefixedBytes(parts, fields.payloadHash);
+	return new Uint8Array(parts);
+}
+
 function appendLengthPrefixedString(dst: number[], value: string): void {
 	const bytes = new TextEncoder().encode(value);
 	appendLengthPrefixedBytes(dst, bytes);