feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/README.md

@@ -94,8 +94,20 @@ The authenticated edge listener is built on
 the Connect, gRPC, and gRPC-Web protocols on a single HTTP/2 cleartext
 (`h2c`) port. Browser clients use `@connectrpc/connect-web`; native
 clients can use either Connect or raw gRPC framing against the same
-listener. Production TLS termination happens upstream of the gateway,
-matching the previous gRPC-only deployment posture.
+listener. TLS termination happens upstream of the gateway at the edge
+Caddy, which fronts both transports under one host.
+
+Both transports are served same-origin under one host. The edge routes
+public REST and the health probe at `/api/*` and `/healthz` to the
+public listener, and the authenticated Connect/gRPC-Web surface at
+`/rpc/*` to the authenticated listener (the `/rpc` prefix is stripped
+before the gateway). Because the game UI is served from the same origin,
+the gateway runs with CORS disabled by default: both
+`GATEWAY_PUBLIC_HTTP_CORS_ALLOWED_ORIGINS` and
+`GATEWAY_AUTHENTICATED_GRPC_CORS_ALLOWED_ORIGINS` are empty, an empty
+allow-list turns the CORS middleware off, and responses carry no
+`Access-Control-*` headers. Those knobs would only be repopulated if a
+deployment ever fronted the gateway on a different host than the UI.
 
 ### Public REST Surface
 
@@ -225,10 +237,13 @@ It binds the stream to `user_id` and `device_session_id` and starts by sending
 a signed service event that includes the current server time in milliseconds.
 
 The v1 protobuf contract lives in
-`proto/galaxy/gateway/v1/edge_gateway.proto` under package
-`galaxy.gateway.v1` and service `EdgeGateway`.
+`proto/edge/v1/edge_gateway.proto` under package `edge.v1` and service
+`Gateway`. Browser and native clients address its methods at
+`/rpc/edge.v1.Gateway/<Method>`; the edge Caddy strips the `/rpc`
+prefix so the gateway listener sees the proto-derived
+`/edge.v1.Gateway/<Method>` path.
 Generated Go bindings are committed under
-`proto/galaxy/gateway/v1/` (gRPC stubs and `gatewayv1connect/` Connect
+`proto/edge/v1/` (gRPC stubs and `edgev1connect/` Connect
 handlers) and are regenerated with:
 
 ```bash