feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/internal/grpcapi/server.go

@@ -24,8 +24,8 @@ import (
 	"galaxy/gateway/internal/replay"
 	"galaxy/gateway/internal/session"
 	"galaxy/gateway/internal/telemetry"
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
-	"galaxy/gateway/proto/galaxy/gateway/v1/gatewayv1connect"
+	edgev1 "galaxy/gateway/proto/edge/v1"
+	"galaxy/gateway/proto/edge/v1/edgev1connect"
 
 	"connectrpc.com/connect"
 	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
@@ -42,7 +42,7 @@ type ServerDependencies struct {
 	// after the initial authenticated service event has been sent. When nil, the
 	// gateway keeps authenticated SubscribeEvents streams open until the client
 	// cancels them, the server shuts down, or a later stream send fails.
-	Service gatewayv1.EdgeGatewayServer
+	Service edgev1.GatewayServer
 
 	// Router resolves the exact downstream unary client for the verified
 	// message_type value. When nil, the authenticated unary surface uses an
@@ -93,7 +93,7 @@ type ServerDependencies struct {
 // single net/http listener.
 type Server struct {
 	cfg     config.AuthenticatedGRPCConfig
-	service gatewayv1.EdgeGatewayServer
+	service edgev1.GatewayServer
 	logger  *zap.Logger
 	pushHub *push.Hub
 	metrics *telemetry.Runtime
@@ -169,7 +169,7 @@ func (s *Server) Run(ctx context.Context) error {
 
 	mux := http.NewServeMux()
 	connectHandler := newConnectEdgeAdapter(s.service)
-	path, handler := gatewayv1connect.NewEdgeGatewayHandler(
+	path, handler := edgev1connect.NewGatewayHandler(
 		connectHandler,
 		connect.WithInterceptors(observabilityConnectInterceptor(s.logger, s.metrics)),
 	)