feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

gateway/internal/grpcapi/test_fixtures_test.go

@@ -13,8 +13,8 @@ import (
 	"galaxy/gateway/authn"
 	"galaxy/gateway/internal/downstream"
 	"galaxy/gateway/internal/session"
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
-	"galaxy/gateway/proto/galaxy/gateway/v1/gatewayv1connect"
+	edgev1 "galaxy/gateway/proto/edge/v1"
+	"galaxy/gateway/proto/edge/v1/edgev1connect"
 
 	gatewayfbs "galaxy/schema/fbs/gateway"
 
@@ -29,19 +29,19 @@ var (
 	testFreshnessWindow = 5 * time.Minute
 )
 
-func newValidExecuteCommandRequest() *gatewayv1.ExecuteCommandRequest {
+func newValidExecuteCommandRequest() *edgev1.ExecuteCommandRequest {
 	return newValidExecuteCommandRequestWithSessionAndRequestID("device-session-123", "request-123")
 }
 
-func newValidExecuteCommandRequestWithSessionAndRequestID(deviceSessionID string, requestID string) *gatewayv1.ExecuteCommandRequest {
+func newValidExecuteCommandRequestWithSessionAndRequestID(deviceSessionID string, requestID string) *edgev1.ExecuteCommandRequest {
 	return newValidExecuteCommandRequestWithTimestamp(deviceSessionID, requestID, testCurrentTime.UnixMilli())
 }
 
-func newValidExecuteCommandRequestWithTimestamp(deviceSessionID string, requestID string, timestampMS int64) *gatewayv1.ExecuteCommandRequest {
+func newValidExecuteCommandRequestWithTimestamp(deviceSessionID string, requestID string, timestampMS int64) *edgev1.ExecuteCommandRequest {
 	payloadBytes := []byte("payload")
 	payloadHash := sha256.Sum256(payloadBytes)
 
-	req := &gatewayv1.ExecuteCommandRequest{
+	req := &edgev1.ExecuteCommandRequest{
 		ProtocolVersion: supportedProtocolVersion,
 		DeviceSessionId: deviceSessionID,
 		MessageType:     "fleet.move",
@@ -56,18 +56,18 @@ func newValidExecuteCommandRequestWithTimestamp(deviceSessionID string, requestI
 	return req
 }
 
-func newValidSubscribeEventsRequest() *gatewayv1.SubscribeEventsRequest {
+func newValidSubscribeEventsRequest() *edgev1.SubscribeEventsRequest {
 	return newValidSubscribeEventsRequestWithSessionAndRequestID("device-session-123", "request-123")
 }
 
-func newValidSubscribeEventsRequestWithSessionAndRequestID(deviceSessionID string, requestID string) *gatewayv1.SubscribeEventsRequest {
+func newValidSubscribeEventsRequestWithSessionAndRequestID(deviceSessionID string, requestID string) *edgev1.SubscribeEventsRequest {
 	return newValidSubscribeEventsRequestWithTimestamp(deviceSessionID, requestID, testCurrentTime.UnixMilli())
 }
 
-func newValidSubscribeEventsRequestWithTimestamp(deviceSessionID string, requestID string, timestampMS int64) *gatewayv1.SubscribeEventsRequest {
+func newValidSubscribeEventsRequestWithTimestamp(deviceSessionID string, requestID string, timestampMS int64) *edgev1.SubscribeEventsRequest {
 	payloadHash := sha256.Sum256(nil)
 
-	req := &gatewayv1.SubscribeEventsRequest{
+	req := &edgev1.SubscribeEventsRequest{
 		ProtocolVersion: supportedProtocolVersion,
 		DeviceSessionId: deviceSessionID,
 		MessageType:     "gateway.subscribe",
@@ -172,7 +172,7 @@ func (c fixedClock) Now() time.Time {
 func recvBootstrapEvent(t interface {
 	require.TestingT
 	Helper()
-}, stream *connect.ServerStreamForClient[gatewayv1.GatewayEvent]) *gatewayv1.GatewayEvent {
+}, stream *connect.ServerStreamForClient[edgev1.GatewayEvent]) *edgev1.GatewayEvent {
 	t.Helper()
 
 	if !stream.Receive() {
@@ -189,7 +189,7 @@ func recvBootstrapEvent(t interface {
 func subscribeEventsError(t interface {
 	require.TestingT
 	Helper()
-}, ctx context.Context, client gatewayv1connect.EdgeGatewayClient, req *gatewayv1.SubscribeEventsRequest) error {
+}, ctx context.Context, client edgev1connect.GatewayClient, req *edgev1.SubscribeEventsRequest) error {
 	t.Helper()
 
 	stream, err := client.SubscribeEvents(ctx, connect.NewRequest(req))
@@ -208,7 +208,7 @@ func subscribeEventsError(t interface {
 func assertServerTimeBootstrapEvent(t interface {
 	require.TestingT
 	Helper()
-}, event *gatewayv1.GatewayEvent, publicKey ed25519.PublicKey, wantRequestID string, wantTraceID string, wantTimestampMS int64) {
+}, event *edgev1.GatewayEvent, publicKey ed25519.PublicKey, wantRequestID string, wantTraceID string, wantTimestampMS int64) {
 	t.Helper()
 
 	require.NotNil(t, event)
@@ -244,7 +244,7 @@ func (s staticReplayStore) Reserve(ctx context.Context, deviceSessionID string,
 }
 
 type executeCommandAdapterRouter struct {
-	service gatewayv1.EdgeGatewayServer
+	service edgev1.GatewayServer
 }
 
 func (r executeCommandAdapterRouter) Route(string) (downstream.Client, error) {
@@ -252,11 +252,11 @@ func (r executeCommandAdapterRouter) Route(string) (downstream.Client, error) {
 }
 
 type executeCommandAdapterClient struct {
-	service gatewayv1.EdgeGatewayServer
+	service edgev1.GatewayServer
 }
 
 func (c executeCommandAdapterClient) ExecuteCommand(ctx context.Context, command downstream.AuthenticatedCommand) (downstream.UnaryResult, error) {
-	response, err := c.service.ExecuteCommand(ctx, &gatewayv1.ExecuteCommandRequest{
+	response, err := c.service.ExecuteCommand(ctx, &edgev1.ExecuteCommandRequest{
 		ProtocolVersion: command.ProtocolVersion,
 		DeviceSessionId: command.DeviceSessionID,
 		MessageType:     command.MessageType,