feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/internal/grpcapi/command_routing.go

@@ -11,7 +11,7 @@ import (
 	"galaxy/gateway/authn"
 	"galaxy/gateway/internal/clock"
 	"galaxy/gateway/internal/downstream"
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
+	edgev1 "galaxy/gateway/proto/edge/v1"
 
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
@@ -21,9 +21,9 @@ import (
 // commandRoutingService translates the verified authenticated request context
 // into an internal downstream command and signs successful unary responses.
 type commandRoutingService struct {
-	gatewayv1.UnimplementedEdgeGatewayServer
+	edgev1.UnimplementedGatewayServer
 
-	subscribeDelegate gatewayv1.EdgeGatewayServer
+	subscribeDelegate edgev1.GatewayServer
 	router            downstream.Router
 	responseSigner    authn.ResponseSigner
 	clock             clock.Clock
@@ -32,7 +32,7 @@ type commandRoutingService struct {
 
 // ExecuteCommand builds a verified downstream command, routes it by exact
 // message_type, executes it, and signs the resulting unary response.
-func (s commandRoutingService) ExecuteCommand(ctx context.Context, _ *gatewayv1.ExecuteCommandRequest) (*gatewayv1.ExecuteCommandResponse, error) {
+func (s commandRoutingService) ExecuteCommand(ctx context.Context, _ *edgev1.ExecuteCommandRequest) (*edgev1.ExecuteCommandResponse, error) {
 	command, err := authenticatedCommandFromContext(ctx)
 	if err != nil {
 		return nil, err
@@ -80,7 +80,7 @@ func (s commandRoutingService) ExecuteCommand(ctx context.Context, _ *gatewayv1.
 		return nil, status.Error(codes.Unavailable, "response signer is unavailable")
 	}
 
-	return &gatewayv1.ExecuteCommandResponse{
+	return &edgev1.ExecuteCommandResponse{
 		ProtocolVersion: command.ProtocolVersion,
 		RequestId:       command.RequestID,
 		TimestampMs:     responseTimestampMS,
@@ -93,13 +93,13 @@ func (s commandRoutingService) ExecuteCommand(ctx context.Context, _ *gatewayv1.
 
 // SubscribeEvents delegates to the authenticated streaming service
 // implementation selected during server construction.
-func (s commandRoutingService) SubscribeEvents(req *gatewayv1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[gatewayv1.GatewayEvent]) error {
+func (s commandRoutingService) SubscribeEvents(req *edgev1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[edgev1.GatewayEvent]) error {
 	return s.subscribeDelegate.SubscribeEvents(req, stream)
 }
 
 // newCommandRoutingService constructs the final authenticated service that
 // owns verified unary routing while preserving the delegated streaming path.
-func newCommandRoutingService(subscribeDelegate gatewayv1.EdgeGatewayServer, router downstream.Router, responseSigner authn.ResponseSigner, clk clock.Clock, downstreamTimeout time.Duration) gatewayv1.EdgeGatewayServer {
+func newCommandRoutingService(subscribeDelegate edgev1.GatewayServer, router downstream.Router, responseSigner authn.ResponseSigner, clk clock.Clock, downstreamTimeout time.Duration) edgev1.GatewayServer {
 	return commandRoutingService{
 		subscribeDelegate: subscribeDelegate,
 		router:            router,
@@ -142,4 +142,4 @@ func (unavailableResponseSigner) SignEvent(authn.EventSigningFields) ([]byte, er
 	return nil, errors.New("response signer is unavailable")
 }
 
-var _ gatewayv1.EdgeGatewayServer = commandRoutingService{}
+var _ edgev1.GatewayServer = commandRoutingService{}