feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/internal/grpcapi/server_test.go

@@ -12,8 +12,8 @@ import (
 	"galaxy/gateway/internal/app"
 	"galaxy/gateway/internal/config"
 	"galaxy/gateway/internal/session"
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
-	"galaxy/gateway/proto/galaxy/gateway/v1/gatewayv1connect"
+	edgev1 "galaxy/gateway/proto/edge/v1"
+	"galaxy/gateway/proto/edge/v1/edgev1connect"
 
 	"connectrpc.com/connect"
 	"github.com/stretchr/testify/assert"
@@ -30,7 +30,7 @@ func TestExecuteCommandRejectsMalformedEnvelope(t *testing.T) {
 	addr := waitForListenAddr(t, server)
 	client := newEdgeClient(t, addr)
 
-	_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(&gatewayv1.ExecuteCommandRequest{}))
+	_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(&edgev1.ExecuteCommandRequest{}))
 	require.Error(t, err)
 	assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
 }
@@ -44,7 +44,7 @@ func TestSubscribeEventsRejectsMalformedEnvelope(t *testing.T) {
 	addr := waitForListenAddr(t, server)
 	client := newEdgeClient(t, addr)
 
-	err := subscribeEventsError(t, context.Background(), client, &gatewayv1.SubscribeEventsRequest{})
+	err := subscribeEventsError(t, context.Background(), client, &edgev1.SubscribeEventsRequest{})
 	require.Error(t, err)
 	assert.Equal(t, connect.CodeInvalidArgument, connect.CodeOf(err))
 }
@@ -58,7 +58,7 @@ func TestExecuteCommandRejectsUnsupportedProtocolVersion(t *testing.T) {
 	addr := waitForListenAddr(t, server)
 	client := newEdgeClient(t, addr)
 
-	_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(&gatewayv1.ExecuteCommandRequest{
+	_, err := client.ExecuteCommand(context.Background(), connect.NewRequest(&edgev1.ExecuteCommandRequest{
 		ProtocolVersion: "v2",
 		DeviceSessionId: "device-session-123",
 		MessageType:     "fleet.move",
@@ -418,7 +418,7 @@ func waitForListenAddr(t *testing.T, server *Server) string {
 // authenticated edge listener. AllowHTTP forces the client to issue plain
 // HTTP/2 requests (h2c) instead of attempting TLS, which the gateway's
 // in-process test bootstrap does not configure.
-func newEdgeClient(t *testing.T, addr string) gatewayv1connect.EdgeGatewayClient {
+func newEdgeClient(t *testing.T, addr string) edgev1connect.GatewayClient {
 	t.Helper()
 
 	httpClient := &http.Client{
@@ -429,7 +429,7 @@ func newEdgeClient(t *testing.T, addr string) gatewayv1connect.EdgeGatewayClient
 			},
 		},
 	}
-	return gatewayv1connect.NewEdgeGatewayClient(httpClient, "http://"+addr)
+	return edgev1connect.NewGatewayClient(httpClient, "http://"+addr)
 }
 
 // connectErrorMessage extracts the *connect.Error message from err. It