feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/dev-deploy/Caddyfile.dev

@@ -1,51 +1,68 @@
 # Application-routing Caddy for the long-lived dev environment.
-# Listens only on the `edge` Docker network; TLS termination and the
-# real `:80`/`:443` listeners belong to the host Caddy in front of us.
+# Single-origin, path-based: the project site, the game UI, and both
+# gateway surfaces live behind one host. TLS termination and the real
+# `:80`/`:443` listeners belong to the host Caddy in front of us.
 #
-# `/srv/galaxy-ui` is mounted from the `galaxy-dev-ui-dist` named volume,
-# refreshed on every dev-deploy run.
-{
+#   /                -> project site   (galaxy-dev-site-dist -> /srv/galaxy-site)
+#   /game/*          -> game UI        (galaxy-dev-ui-dist  -> /srv/galaxy-ui)
+#   /api/*, /healthz -> gateway public REST       (galaxy-api:8080)
+#   /rpc/*           -> gateway Connect/gRPC-web  (galaxy-api:9090)
+#
+# The same artifact is domain-agnostic: nothing here names a host, so an
+# identical bundle serves galaxy.lan, galaxy.iliadenisov.ru, or any
+# other domain the host Caddy terminates.
 {
-}
+	auto_https off
 }
 
 :80 {
-    handle @frontend {
-        root * /srv/galaxy-ui
-
+	# Authenticated Connect-Web edge. The browser calls
+	# `/rpc/edge.v1.Gateway/<Method>`; strip the `/rpc` prefix so the
+	# gateway sees the proto-derived service path on its :9090 listener.
+	handle_path /rpc/* {
+		reverse_proxy galaxy-api:9090
+	}
 
-        # `_app/immutable/`; the file name changes whenever the
-        # content changes, so the browser can cache them forever.
-        # Without an explicit Cache-Control, Caddy falls back to
-        # heuristic caching that revalidates on every reload —
-        # measurably slow on Safari + the long-lived dev stack
-        # when the cache is warm. Everything else (index.html
-        # fallback, env.js, version.json, core.wasm,
-        # wasm_exec.js, favicon.svg) must revalidate so a fresh
-        # deploy lands without the user having to clear the
-        # cache by hand.
-        @immutable path /_app/immutable/*
-        header @immutable Cache-Control "public, max-age=31536000, immutable"
-        @dynamic not path /_app/immutable/*
-        header @dynamic Cache-Control "no-cache, must-revalidate"
-
+	# Gateway public REST (auth) and the health probe on :8080.
+	@api path /api/* /healthz
+	handle @api {
+		reverse_proxy galaxy-api:8080
+	}
 
-        file_server
-        encode zstd gzip
-    }
-
+	# Bare `/game` (no trailing slash) -> `/game/` so the SPA root
+	# resolves before the site catch-all can claim it.
+	handle /game {
+		redir * /game/ 308
+	}
 
-    handle @api {
-        # Connect-Web (authenticated) lives on a separate listener
-        # (`GATEWAY_AUTHENTICATED_GRPC_ADDR=:9090`). Anything else —
-        # public auth, healthz — is the public REST listener on
-        # `:8080`. The split mirrors the Vite dev-server proxy in
-        # `ui/frontend/vite.config.ts`.
-        @connect path /galaxy.gateway.v1.EdgeGateway/*
-        handle @connect {
-            reverse_proxy galaxy-api:9090
-        }
-        reverse_proxy galaxy-api:8080
-    }
-}
+	# Game UI under `/game/`. The bundle is built with base=/game, so it
+	# references `/game/_app/...`; strip the prefix to serve the build
+	# whose files sit at the volume root. SPA fallback to index.html.
+	handle_path /game/* {
+		root * /srv/galaxy-ui
+		# Hash-named, content-addressed chunks: cache forever.
+		@immutable path /_app/immutable/*
+		header @immutable Cache-Control "public, max-age=31536000, immutable"
+		# index.html, env.js, version.json, core.wasm, wasm_exec.js,
+		# favicon, manifest, service-worker.js must revalidate so a
+		# fresh deploy lands without a manual cache clear.
+		@dynamic not path /_app/immutable/*
+		header @dynamic Cache-Control "no-cache, must-revalidate"
+		try_files {path} /index.html
+		file_server
+		encode zstd gzip
+	}
+
+	# Project site at the root (VitePress static output).
+	handle {
+		root * /srv/galaxy-site
+		# VitePress emits hash-named assets under `/assets/`.
+		@immutable path /assets/*
+		header @immutable Cache-Control "public, max-age=31536000, immutable"
+		@dynamic not path /assets/*
+		header @dynamic Cache-Control "no-cache, must-revalidate"
+		try_files {path} {path}.html {path}/index.html /404.html
+		file_server
+		encode zstd gzip
+	}
 }