feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/internal/grpcapi/envelope.go

@@ -4,7 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
+	edgev1 "galaxy/gateway/proto/edge/v1"
 
 	"buf.build/go/protovalidate"
 	"google.golang.org/grpc"
@@ -47,14 +47,14 @@ func parsedEnvelopeFromContext(ctx context.Context) (parsedEnvelope, bool) {
 // envelopeValidatingService applies envelope parsing and the protocol gate
 // before delegating to the configured service implementation.
 type envelopeValidatingService struct {
-	gatewayv1.UnimplementedEdgeGatewayServer
+	edgev1.UnimplementedGatewayServer
 
-	delegate gatewayv1.EdgeGatewayServer
+	delegate edgev1.GatewayServer
 }
 
 // ExecuteCommand validates req and only then forwards it to the configured
 // delegate with the parsed envelope attached to ctx.
-func (s envelopeValidatingService) ExecuteCommand(ctx context.Context, req *gatewayv1.ExecuteCommandRequest) (*gatewayv1.ExecuteCommandResponse, error) {
+func (s envelopeValidatingService) ExecuteCommand(ctx context.Context, req *edgev1.ExecuteCommandRequest) (*edgev1.ExecuteCommandResponse, error) {
 	envelope, err := parseExecuteCommandRequest(req)
 	if err != nil {
 		return nil, err
@@ -65,7 +65,7 @@ func (s envelopeValidatingService) ExecuteCommand(ctx context.Context, req *gate
 
 // SubscribeEvents validates req and only then forwards it to the configured
 // delegate with the parsed envelope attached to the stream context.
-func (s envelopeValidatingService) SubscribeEvents(req *gatewayv1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[gatewayv1.GatewayEvent]) error {
+func (s envelopeValidatingService) SubscribeEvents(req *edgev1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[edgev1.GatewayEvent]) error {
 	envelope, err := parseSubscribeEventsRequest(req)
 	if err != nil {
 		return err
@@ -79,7 +79,7 @@ func (s envelopeValidatingService) SubscribeEvents(req *gatewayv1.SubscribeEvent
 
 // parseExecuteCommandRequest validates req according to the request-envelope
 // rules and returns a cloned parsed envelope suitable for later auth steps.
-func parseExecuteCommandRequest(req *gatewayv1.ExecuteCommandRequest) (parsedEnvelope, error) {
+func parseExecuteCommandRequest(req *edgev1.ExecuteCommandRequest) (parsedEnvelope, error) {
 	if req == nil {
 		return parsedEnvelope{}, newMalformedEnvelopeError("request envelope must not be nil")
 	}
@@ -105,7 +105,7 @@ func parseExecuteCommandRequest(req *gatewayv1.ExecuteCommandRequest) (parsedEnv
 
 // parseSubscribeEventsRequest validates req according to the request-envelope
 // rules and returns a cloned parsed envelope suitable for later auth steps.
-func parseSubscribeEventsRequest(req *gatewayv1.SubscribeEventsRequest) (parsedEnvelope, error) {
+func parseSubscribeEventsRequest(req *edgev1.SubscribeEventsRequest) (parsedEnvelope, error) {
 	if req == nil {
 		return parsedEnvelope{}, newMalformedEnvelopeError("request envelope must not be nil")
 	}
@@ -131,13 +131,13 @@ func parseSubscribeEventsRequest(req *gatewayv1.SubscribeEventsRequest) (parsedE
 
 // newEnvelopeValidatingService wraps delegate with the envelope-validation
 // gate.
-func newEnvelopeValidatingService(delegate gatewayv1.EdgeGatewayServer) gatewayv1.EdgeGatewayServer {
+func newEnvelopeValidatingService(delegate edgev1.GatewayServer) edgev1.GatewayServer {
 	return envelopeValidatingService{delegate: delegate}
 }
 
 // canonicalExecuteCommandValidationError maps any ExecuteCommand validation
 // failure into the stable canonical error chosen by field order.
-func canonicalExecuteCommandValidationError(req *gatewayv1.ExecuteCommandRequest) error {
+func canonicalExecuteCommandValidationError(req *edgev1.ExecuteCommandRequest) error {
 	switch {
 	case req.GetProtocolVersion() == "":
 		return newMalformedEnvelopeError("protocol_version must not be empty")
@@ -162,7 +162,7 @@ func canonicalExecuteCommandValidationError(req *gatewayv1.ExecuteCommandRequest
 
 // canonicalSubscribeEventsValidationError maps any SubscribeEvents validation
 // failure into the stable canonical error chosen by field order.
-func canonicalSubscribeEventsValidationError(req *gatewayv1.SubscribeEventsRequest) error {
+func canonicalSubscribeEventsValidationError(req *edgev1.SubscribeEventsRequest) error {
 	switch {
 	case req.GetProtocolVersion() == "":
 		return newMalformedEnvelopeError("protocol_version must not be empty")
@@ -198,7 +198,7 @@ func newUnsupportedProtocolVersionError(version string) error {
 type parsedEnvelopeContextKey struct{}
 
 type envelopeContextStream struct {
-	grpc.ServerStreamingServer[gatewayv1.GatewayEvent]
+	grpc.ServerStreamingServer[edgev1.GatewayEvent]
 	ctx context.Context
 }
 
@@ -210,4 +210,4 @@ func (s envelopeContextStream) Context() context.Context {
 	return s.ctx
 }
 
-var _ gatewayv1.EdgeGatewayServer = envelopeValidatingService{}
+var _ edgev1.GatewayServer = envelopeValidatingService{}