feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

integration/testenv/connect_client.go

@@ -15,8 +15,8 @@ import (
 	"time"
 
 	gatewayauthn "galaxy/gateway/authn"
-	gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"
-	"galaxy/gateway/proto/galaxy/gateway/v1/gatewayv1connect"
+	edgev1 "galaxy/gateway/proto/edge/v1"
+	"galaxy/gateway/proto/edge/v1/edgev1connect"
 
 	"connectrpc.com/connect"
 	"github.com/google/uuid"
@@ -32,7 +32,7 @@ import (
 // alongside gRPC and gRPC-Web on the same port.
 type SignedGatewayClient struct {
 	httpClient *http.Client
-	edge       gatewayv1connect.EdgeGatewayClient
+	edge       edgev1connect.GatewayClient
 	deviceSID  string
 	privateKey ed25519.PrivateKey
 	respPub    ed25519.PublicKey
@@ -75,7 +75,7 @@ func DialGateway(_ context.Context, addr string, deviceSID string, privateKey ed
 			},
 		},
 	}
-	edge := gatewayv1connect.NewEdgeGatewayClient(httpClient, "http://"+addr)
+	edge := edgev1connect.NewGatewayClient(httpClient, "http://"+addr)
 
 	return &SignedGatewayClient{
 		httpClient: httpClient,
@@ -164,7 +164,7 @@ func (c *SignedGatewayClient) Execute(ctx context.Context, messageType string, p
 		signature = ed25519.Sign(c.privateKey, input)
 	}
 
-	req := &gatewayv1.ExecuteCommandRequest{
+	req := &edgev1.ExecuteCommandRequest{
 		ProtocolVersion: protocolVersion,
 		DeviceSessionId: deviceSID,
 		MessageType:     messageType,
@@ -209,7 +209,7 @@ func (c *SignedGatewayClient) Execute(ctx context.Context, messageType string, p
 // authenticated event the gateway delivers; the channel closes when
 // the stream ends or when ctx is done. Errors land on the err
 // channel.
-func (c *SignedGatewayClient) SubscribeEvents(ctx context.Context, messageType string) (<-chan *gatewayv1.GatewayEvent, <-chan error, error) {
+func (c *SignedGatewayClient) SubscribeEvents(ctx context.Context, messageType string) (<-chan *edgev1.GatewayEvent, <-chan error, error) {
 	requestID := uuid.NewString()
 	timestampMS := time.Now().UnixMilli()
 	protocolVersion := "v1"
@@ -224,7 +224,7 @@ func (c *SignedGatewayClient) SubscribeEvents(ctx context.Context, messageType s
 		PayloadHash:     emptyHash[:],
 	}))
 
-	stream, err := c.edge.SubscribeEvents(ctx, connect.NewRequest(&gatewayv1.SubscribeEventsRequest{
+	stream, err := c.edge.SubscribeEvents(ctx, connect.NewRequest(&edgev1.SubscribeEventsRequest{
 		ProtocolVersion: protocolVersion,
 		DeviceSessionId: c.deviceSID,
 		MessageType:     messageType,
@@ -237,7 +237,7 @@ func (c *SignedGatewayClient) SubscribeEvents(ctx context.Context, messageType s
 		return nil, nil, fmt.Errorf("open subscribe events: %w", err)
 	}
 
-	events := make(chan *gatewayv1.GatewayEvent, 16)
+	events := make(chan *edgev1.GatewayEvent, 16)
 	errs := make(chan error, 1)
 	go func() {
 		defer close(events)