feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/internal/grpcapi/push_fanout.go

@@ -11,7 +11,7 @@ import (
 	"galaxy/gateway/internal/logging"
 	"galaxy/gateway/internal/push"
 	"galaxy/gateway/internal/telemetry"
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
+	edgev1 "galaxy/gateway/proto/edge/v1"
 
 	"go.uber.org/zap"
 	"google.golang.org/grpc"
@@ -22,7 +22,7 @@ import (
 // NewFanOutPushStreamService constructs the authenticated SubscribeEvents tail
 // service that registers active streams in hub and forwards client-facing
 // events after the bootstrap event has been sent.
-func NewFanOutPushStreamService(hub *push.Hub, responseSigner authn.ResponseSigner, clk clock.Clock, logger *zap.Logger) gatewayv1.EdgeGatewayServer {
+func NewFanOutPushStreamService(hub *push.Hub, responseSigner authn.ResponseSigner, clk clock.Clock, logger *zap.Logger) edgev1.GatewayServer {
 	if responseSigner == nil {
 		responseSigner = unavailableResponseSigner{}
 	}
@@ -44,7 +44,7 @@ func NewFanOutPushStreamService(hub *push.Hub, responseSigner authn.ResponseSign
 // fanOutPushStreamService owns the post-bootstrap authenticated push-stream
 // lifecycle backed by the in-memory push hub.
 type fanOutPushStreamService struct {
-	gatewayv1.UnimplementedEdgeGatewayServer
+	edgev1.UnimplementedGatewayServer
 
 	hub            *push.Hub
 	responseSigner authn.ResponseSigner
@@ -54,7 +54,7 @@ type fanOutPushStreamService struct {
 
 // SubscribeEvents registers the verified stream in the push hub and forwards
 // matching client-facing events until the stream ends.
-func (s fanOutPushStreamService) SubscribeEvents(_ *gatewayv1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[gatewayv1.GatewayEvent]) error {
+func (s fanOutPushStreamService) SubscribeEvents(_ *edgev1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[edgev1.GatewayEvent]) error {
 	binding, ok := authenticatedStreamBindingFromContext(stream.Context())
 	if !ok {
 		return status.Error(codes.Internal, "authenticated request context is incomplete")
@@ -109,7 +109,7 @@ func (s fanOutPushStreamService) SubscribeEvents(_ *gatewayv1.SubscribeEventsReq
 	}
 }
 
-func (s fanOutPushStreamService) buildGatewayEvent(event push.Event) (*gatewayv1.GatewayEvent, error) {
+func (s fanOutPushStreamService) buildGatewayEvent(event push.Event) (*edgev1.GatewayEvent, error) {
 	timestampMS := s.clock.Now().UTC().UnixMilli()
 	payloadHash := sha256.Sum256(event.PayloadBytes)
 
@@ -125,7 +125,7 @@ func (s fanOutPushStreamService) buildGatewayEvent(event push.Event) (*gatewayv1
 		return nil, status.Error(codes.Unavailable, "response signer is unavailable")
 	}
 
-	return &gatewayv1.GatewayEvent{
+	return &edgev1.GatewayEvent{
 		EventType:    event.EventType,
 		EventId:      event.EventID,
 		TimestampMs:  timestampMS,
@@ -169,4 +169,4 @@ func mapSubscriptionOutcome(err error) telemetry.EdgeOutcome {
 	}
 }
 
-var _ gatewayv1.EdgeGatewayServer = fanOutPushStreamService{}
+var _ edgev1.GatewayServer = fanOutPushStreamService{}