feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/internal/grpcapi/push_stream.go

@@ -9,7 +9,7 @@ import (
 	"galaxy/gateway/authn"
 	"galaxy/gateway/internal/clock"
 	"galaxy/gateway/internal/telemetry"
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
+	edgev1 "galaxy/gateway/proto/edge/v1"
 	gatewayfbs "galaxy/schema/fbs/gateway"
 
 	flatbuffers "github.com/google/flatbuffers/go"
@@ -81,9 +81,9 @@ func authenticatedStreamBindingFromContext(ctx context.Context) (authenticatedSt
 // the tail performs and only emits a heartbeat when the silence window
 // elapses; tails remain heartbeat-unaware.
 type authenticatedPushStreamService struct {
-	gatewayv1.UnimplementedEdgeGatewayServer
+	edgev1.UnimplementedGatewayServer
 
-	tailDelegate      gatewayv1.EdgeGatewayServer
+	tailDelegate      edgev1.GatewayServer
 	responseSigner    authn.ResponseSigner
 	clock             clock.Clock
 	heartbeatInterval time.Duration
@@ -92,7 +92,7 @@ type authenticatedPushStreamService struct {
 
 // SubscribeEvents binds the verified stream identity, sends the initial signed
 // server-time event, and then delegates the remaining lifecycle.
-func (s authenticatedPushStreamService) SubscribeEvents(req *gatewayv1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[gatewayv1.GatewayEvent]) error {
+func (s authenticatedPushStreamService) SubscribeEvents(req *edgev1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[edgev1.GatewayEvent]) error {
 	envelope, ok := parsedEnvelopeFromContext(stream.Context())
 	if !ok {
 		return status.Error(codes.Internal, "authenticated request context is incomplete")
@@ -134,7 +134,7 @@ func (s authenticatedPushStreamService) SubscribeEvents(req *gatewayv1.Subscribe
 		return status.Error(codes.Unavailable, "response signer is unavailable")
 	}
 
-	if err := boundStream.Send(&gatewayv1.GatewayEvent{
+	if err := boundStream.Send(&edgev1.GatewayEvent{
 		EventType:    serverTimeEventType,
 		EventId:      envelope.RequestID,
 		TimestampMs:  serverTimeMS,
@@ -147,7 +147,7 @@ func (s authenticatedPushStreamService) SubscribeEvents(req *gatewayv1.Subscribe
 		return err
 	}
 
-	var streamForTail grpc.ServerStreamingServer[gatewayv1.GatewayEvent] = boundStream
+	var streamForTail grpc.ServerStreamingServer[edgev1.GatewayEvent] = boundStream
 	if hbStream := newHeartbeatingStream(boundStream, s.heartbeatInterval, s.metrics); hbStream != nil {
 		defer hbStream.Stop()
 		go func() {
@@ -165,12 +165,12 @@ func (s authenticatedPushStreamService) SubscribeEvents(req *gatewayv1.Subscribe
 }
 
 func newAuthenticatedPushStreamService(
-	tailDelegate gatewayv1.EdgeGatewayServer,
+	tailDelegate edgev1.GatewayServer,
 	responseSigner authn.ResponseSigner,
 	clk clock.Clock,
 	heartbeatInterval time.Duration,
 	metrics *telemetry.Runtime,
-) gatewayv1.EdgeGatewayServer {
+) edgev1.GatewayServer {
 	if tailDelegate == nil {
 		tailDelegate = holdOpenSubscribeEventsService{}
 	}
@@ -197,7 +197,7 @@ func buildServerTimeEventPayload(serverTimeMS int64) []byte {
 type authenticatedStreamBindingContextKey struct{}
 
 type authenticatedStreamContextStream struct {
-	grpc.ServerStreamingServer[gatewayv1.GatewayEvent]
+	grpc.ServerStreamingServer[edgev1.GatewayEvent]
 	ctx context.Context
 }
 
@@ -210,12 +210,12 @@ func (s authenticatedStreamContextStream) Context() context.Context {
 }
 
 type holdOpenSubscribeEventsService struct {
-	gatewayv1.UnimplementedEdgeGatewayServer
+	edgev1.UnimplementedGatewayServer
 }
 
-func (holdOpenSubscribeEventsService) SubscribeEvents(_ *gatewayv1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[gatewayv1.GatewayEvent]) error {
+func (holdOpenSubscribeEventsService) SubscribeEvents(_ *edgev1.SubscribeEventsRequest, stream grpc.ServerStreamingServer[edgev1.GatewayEvent]) error {
 	<-stream.Context().Done()
 	return stream.Context().Err()
 }
 
-var _ gatewayv1.EdgeGatewayServer = authenticatedPushStreamService{}
+var _ edgev1.GatewayServer = authenticatedPushStreamService{}