feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -579,13 +579,25 @@ behaviour for any of its guarantees.
 
 The authenticated edge listener is built on `connectrpc.com/connect` and
 natively serves the Connect, gRPC, and gRPC-Web protocols on a single
-HTTP/2 cleartext (`h2c`) port. Browser clients use Connect via
-`@connectrpc/connect-web`; native iOS / Android / desktop clients can
-use either Connect or raw gRPC framing against the same listener.
-Envelope, signature, freshness, and anti-replay rules below are
-protocol-agnostic — they apply identically to every supported wire
+HTTP/2 cleartext (`h2c`) port. The v1 service is `edge.v1.Gateway`;
+browser clients address its methods at `/rpc/edge.v1.Gateway/<Method>`
+and the edge strips the `/rpc` prefix so the gateway sees the
+proto-derived `/edge.v1.Gateway/<Method>` path. Browser clients use
+Connect via `@connectrpc/connect-web`; native iOS / Android / desktop
+clients can use either Connect or raw gRPC framing against the same
+listener. Envelope, signature, freshness, and anti-replay rules below
+are protocol-agnostic — they apply identically to every supported wire
 framing.
 
+Both the authenticated `/rpc/*` surface and the gateway's public REST at
+`/api/*` are served same-origin with the game UI, so the gateway runs
+with CORS disabled by default: the
+`GATEWAY_PUBLIC_HTTP_CORS_ALLOWED_ORIGINS` and
+`GATEWAY_AUTHENTICATED_GRPC_CORS_ALLOWED_ORIGINS` allow-lists are empty,
+which turns the CORS middleware off and emits no `Access-Control-*`
+headers. They would be repopulated only if a deployment fronted the
+gateway on a different host than the UI.
+
 ### Principles
 
 - No browser cookies.
@@ -775,6 +787,9 @@ domain tables.
 
 ### TLS and MITM
 
+TLS terminates once, at the edge in front of the gateway, for the single
+public origin that serves the site, the game UI, and both gateway
+surfaces. A single certificate therefore covers the whole deployment.
 Native clients should use TLS pinning (SPKI-based) in addition to the
 signed exchange. Browser clients rely on browser-managed TLS and the
 signed exchange.
@@ -845,8 +860,10 @@ Branches:
   way in is a PR merge from `development`.
 - `development` — long-lived dev integration branch. Every merge
   triggers an auto-deploy into the long-lived dev environment on the
-  CI host, reachable through the host Caddy at
-  `https://www.galaxy.lan` and `https://api.galaxy.lan`.
+  CI host, reachable through the host Caddy at a single origin
+  `https://galaxy.lan` (project site at `/`, game UI at `/game/`,
+  gateway public REST at `/api/*` and `/healthz`, authenticated
+  Connect/gRPC-Web at `/rpc/*`).
 - `feature/*` — short-lived branches off `development`. Merged back
   via PR; PRs run unit + integration checks before merge.
 
@@ -872,8 +889,9 @@ Environments:
 
 - **`tools/local-dev/`** — single-developer playground. Bound to
   host ports, Vite dev server runs on the host. Not driven by CI.
-- **`tools/dev-deploy/`** — long-lived dev environment behind
-  `*.galaxy.lan`, redeployed on every merge into `development`.
+- **`tools/dev-deploy/`** — long-lived dev environment behind the
+  single origin `galaxy.lan`, redeployed on every merge into
+  `development`.
 - **production** — future. Images come from the
   `galaxy-images-commit-<sha>` artifact produced by `prod-build.yaml`
   and are shipped to the production host via `docker save` →
@@ -913,6 +931,14 @@ untouched by compose between deploys.
 
 ## 19. Deployment Topology (informational)
 
+- The public edge is single-origin and path-based: one host (the dev
+  host is `galaxy.lan`; prod takes the real host from
+  `GALAXY_PUBLIC_HOST`) terminates TLS and routes by path —
+  `/` → project site, `/game/` → game UI, `/api/*` and `/healthz` →
+  gateway public REST (`galaxy-api:8080`), `/rpc/*` → gateway
+  authenticated Connect/gRPC-Web (`galaxy-api:9090`, with the `/rpc`
+  prefix stripped before the gateway). The same dev and prod shape is
+  domain-agnostic: no host name is baked into the deployed artifacts.
 - MVP runs three executables: one `gateway` instance, one `backend`
   instance, and N `galaxy-game-{game_id}` containers managed by backend.
 - One Postgres database is shared by `backend` only.