chore(fbs): pin flatc toolchain to 25.9.23 and guard codegen drift

The committed FlatBuffers bindings were generated by flatc 25.x (the TS
runtime is flatbuffers@25.9.23), but nothing pinned the compiler, so a
regen on a box with an older flatc (Debian apt ships 23.5.26) silently
churns output and flips nullable-scalar builder defaults. PR #82 hit this
and shipped 5 report files from the wrong compiler.

Unify the whole toolchain on 25.9.23 (the only version available as an
npm package, a prebuilt flatc binary, and a Go tag) and make the bindings
reproducible:

- Downgrade the flatbuffers Go module 25.12.19 -> 25.9.23 (schema,
  transcoder, gateway, integration) so compiler and both runtimes match.
- Regenerate every schema with flatc 25.9.23. The only resulting change
  is order/command-item.ts: the lone straggler still on the old
  optional-scalar builder default (cmd_applied/cmd_error_code: 0 -> null).
  Inert in practice — the TS side never builds those response-only fields
  (the engine sets them in Go); the reader is unchanged.
- Pin the version in tooling: a flatc-check guard in ui/Makefile (fbs-ts)
  and a new pkg/schema/fbs/Makefile (fbs-go); both refuse a mismatched
  flatc and point at the release binary. Fix the stale apt install hint.
- Add a path-filtered CI guard (.gitea/workflows/fbs-codegen.yaml) that
  regenerates with the pinned flatc and fails on any diff.
- Document the pinned version and the regen commands in the schema README.

No wire-format change: Go build/vet, transcoder roundtrip + engine tests,
pnpm check and the full vitest suite (888) stay green.

pkg/schema/fbs/Makefile

@@ -0,0 +1,26 @@
+.PHONY: help fbs-go flatc-check
+
+# Pinned flatc version. The committed Go bindings under <schema>/ and the
+# flatbuffers Go runtime (go.mod) are on this version; the TS side mirrors
+# it via `make -C ui fbs-ts`. Generating with a different flatc silently
+# churns output and can flip nullable-scalar wire defaults, so fbs-go
+# refuses to run on a mismatch. Distro packages (e.g. Debian's
+# flatbuffers-compiler) are too old — use the release binary at $(FLATC_URL).
+REQUIRED_FLATC := 25.9.23
+FLATC_URL      := https://github.com/google/flatbuffers/releases/tag/v$(REQUIRED_FLATC)
+# Every schema in this directory. Listed explicitly (not a wildcard) so a
+# stray .fbs cannot silently change the generated set.
+FBS_INPUTS     := common.fbs lobby.fbs user.fbs report.fbs order.fbs diplomail.fbs battle.fbs gateway.fbs notification.fbs
+
+help:
+	@echo "schema/fbs targets:"
+	@echo "  fbs-go   FlatBuffers Go generation from *.fbs into <schema>/ (requires flatc $(REQUIRED_FLATC))"
+
+flatc-check:
+	@command -v flatc >/dev/null || { echo "flatc not found; install flatc $(REQUIRED_FLATC) from $(FLATC_URL) (distro packages such as Debian's flatbuffers-compiler are too old)"; exit 1; }
+	@flatc --version | grep -q "$(REQUIRED_FLATC)" || { echo "flatc $(REQUIRED_FLATC) required; found '$$(flatc --version)'. Get the pinned binary from $(FLATC_URL)"; exit 1; }
+
+# --go-module-name rewrites cross-namespace imports to the fully-qualified
+# module path so the generated code links without local replace directives.
+fbs-go: flatc-check
+	flatc --go --go-module-name galaxy/schema/fbs $(FBS_INPUTS)

pkg/schema/fbs/README.md

@@ -1,9 +1,32 @@
 # Flatbuffers schemas
 
+## Pinned flatc version
+
+The committed bindings — Go under `<schema>/` and TS under
+`ui/frontend/src/proto/galaxy/fbs/` — and the flatbuffers runtimes
+(`github.com/google/flatbuffers` in the Go modules, `flatbuffers` in
+`ui/frontend/package.json`) are all on **flatc 25.9.23**. Regenerate
+only with that exact version: a different flatc silently churns output
+and can flip nullable-scalar wire defaults (`= null` builder slots
+switch between the presence-preserving `null` form and the value-omitting
+`0` form). The `fbs-go` / `fbs-ts` targets refuse to run on a mismatch,
+and the `fbs-codegen` CI workflow fails if the committed bindings differ
+from a pinned-flatc regeneration.
+
+Distro packages are too old (e.g. Debian trixie ships `flatbuffers-compiler`
+23.5.26). Install the pinned binary from the release page:
+<https://github.com/google/flatbuffers/releases/tag/v25.9.23>.
+
 ## Generating sources
 
-Given a `.fbs` file, source code can be generated using `flatc` from
-this directory:
+Regenerate both sides with the pinned `flatc` on `PATH`:
+
+```shell
+make -C pkg/schema/fbs fbs-go   # Go bindings into pkg/schema/fbs/<schema>/
+make -C ui fbs-ts               # TS bindings into ui/frontend/src/proto/galaxy/fbs/
+```
+
+`fbs-go` runs, for every schema in this directory:
 
 ```shell
 flatc --go --go-module-name galaxy/schema/fbs {file}.fbs

pkg/schema/go.mod

@@ -2,4 +2,4 @@ module galaxy/schema
 
 go 1.26.0
 
-require github.com/google/flatbuffers v25.12.19+incompatible
+require github.com/google/flatbuffers v25.9.23+incompatible

pkg/schema/go.sum

@@ -1,2 +1,4 @@
+github.com/google/flatbuffers v25.9.23+incompatible h1:rGZKv+wOb6QPzIdkM2KxhBZCDrA0DeN6DNmRDrqIsQU=
+github.com/google/flatbuffers v25.9.23+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/flatbuffers v25.12.19+incompatible h1:haMV2JRRJCe1998HeW/p0X9UaMTK6SDo0ffLn2+DbLs=
 github.com/google/flatbuffers v25.12.19+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=

pkg/transcoder/go.mod

@@ -3,6 +3,6 @@ module galaxy/transcoder
 go 1.26.0
 
 require (
-	github.com/google/flatbuffers v25.12.19+incompatible
+	github.com/google/flatbuffers v25.9.23+incompatible
 	github.com/google/uuid v1.6.0
 )

pkg/transcoder/go.sum

@@ -1,2 +1,4 @@
-github.com/google/flatbuffers v25.12.19+incompatible h1:haMV2JRRJCe1998HeW/p0X9UaMTK6SDo0ffLn2+DbLs=
+github.com/google/flatbuffers v25.9.23+incompatible h1:rGZKv+wOb6QPzIdkM2KxhBZCDrA0DeN6DNmRDrqIsQU=
+github.com/google/flatbuffers v25.9.23+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=