feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/internal/grpcapi/connect_handler.go

@@ -5,8 +5,8 @@ import (
 	"errors"
 	"fmt"
 
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
-	"galaxy/gateway/proto/galaxy/gateway/v1/gatewayv1connect"
+	edgev1 "galaxy/gateway/proto/edge/v1"
+	"galaxy/gateway/proto/edge/v1/edgev1connect"
 
 	"connectrpc.com/connect"
 	"google.golang.org/grpc/codes"
@@ -17,15 +17,15 @@ import (
 // connectEdgeAdapter exposes the existing gRPC-shaped authenticated edge
 // service decorator stack (envelope → session → payload-hash → signature →
 // freshness/replay → rate-limit → routing/push) through the
-// gatewayv1connect.EdgeGatewayHandler interface. It owns no logic of its
+// edgev1connect.GatewayHandler interface. It owns no logic of its
 // own; the underlying decorator stack carries the full ingress contract
 // unchanged.
 type connectEdgeAdapter struct {
-	impl gatewayv1.EdgeGatewayServer
+	impl edgev1.GatewayServer
 }
 
 // newConnectEdgeAdapter wraps impl as a Connect handler.
-func newConnectEdgeAdapter(impl gatewayv1.EdgeGatewayServer) gatewayv1connect.EdgeGatewayHandler {
+func newConnectEdgeAdapter(impl edgev1.GatewayServer) edgev1connect.GatewayHandler {
 	return &connectEdgeAdapter{impl: impl}
 }
 
@@ -33,7 +33,7 @@ func newConnectEdgeAdapter(impl gatewayv1.EdgeGatewayServer) gatewayv1connect.Ed
 // service, and wraps the typed response. gRPC `status.Error` values
 // returned by the decorator stack are translated to *connect.Error so
 // the Connect client receives the matching code and message.
-func (a *connectEdgeAdapter) ExecuteCommand(ctx context.Context, req *connect.Request[gatewayv1.ExecuteCommandRequest]) (*connect.Response[gatewayv1.ExecuteCommandResponse], error) {
+func (a *connectEdgeAdapter) ExecuteCommand(ctx context.Context, req *connect.Request[edgev1.ExecuteCommandRequest]) (*connect.Response[edgev1.ExecuteCommandResponse], error) {
 	resp, err := a.impl.ExecuteCommand(ctx, req.Msg)
 	if err != nil {
 		return nil, translateGRPCStatusError(err)
@@ -48,7 +48,7 @@ func (a *connectEdgeAdapter) ExecuteCommand(ctx context.Context, req *connect.Re
 // stream; the remaining grpc.ServerStream surface is satisfied by no-op
 // shims so the interface contract is met without panicking. Errors
 // returned by the decorator stack are translated to *connect.Error.
-func (a *connectEdgeAdapter) SubscribeEvents(ctx context.Context, req *connect.Request[gatewayv1.SubscribeEventsRequest], stream *connect.ServerStream[gatewayv1.GatewayEvent]) error {
+func (a *connectEdgeAdapter) SubscribeEvents(ctx context.Context, req *connect.Request[edgev1.SubscribeEventsRequest], stream *connect.ServerStream[edgev1.GatewayEvent]) error {
 	wrapped := &connectEdgeStream{ctx: ctx, stream: stream}
 	if err := a.impl.SubscribeEvents(req.Msg, wrapped); err != nil {
 		return translateGRPCStatusError(err)
@@ -83,19 +83,19 @@ func translateGRPCStatusError(err error) error {
 	return connect.NewError(connect.Code(grpcStatus.Code()), errors.New(grpcStatus.Message()))
 }
 
-// connectEdgeStream satisfies grpc.ServerStreamingServer[gatewayv1.GatewayEvent]
+// connectEdgeStream satisfies grpc.ServerStreamingServer[edgev1.GatewayEvent]
 // on top of *connect.ServerStream. The decorator stack reads the request
 // context and pushes outbound events through Send; the rest of the
 // grpc.ServerStream surface is not exercised in the gateway, so the no-op
 // implementations preserve the type contract without surprising behaviour.
 type connectEdgeStream struct {
 	ctx    context.Context
-	stream *connect.ServerStream[gatewayv1.GatewayEvent]
+	stream *connect.ServerStream[edgev1.GatewayEvent]
 }
 
 // Send forwards a typed gateway event through the underlying Connect server
 // stream.
-func (s *connectEdgeStream) Send(event *gatewayv1.GatewayEvent) error {
+func (s *connectEdgeStream) Send(event *edgev1.GatewayEvent) error {
 	return s.stream.Send(event)
 }
 
@@ -127,7 +127,7 @@ func (s *connectEdgeStream) SetTrailer(metadata.MD) {}
 // SendMsg directly; if a future caller does, the typed Send path is used
 // when the message is a GatewayEvent.
 func (s *connectEdgeStream) SendMsg(m any) error {
-	event, ok := m.(*gatewayv1.GatewayEvent)
+	event, ok := m.(*edgev1.GatewayEvent)
 	if !ok {
 		return fmt.Errorf("connectEdgeStream.SendMsg: unsupported message type %T", m)
 	}