feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/dev-deploy/Caddyfile.prod

@@ -1,25 +1,44 @@
-# Production placeholder. Mirrors `Caddyfile.dev` but uses real
-# hostnames and lets Caddy auto-provision TLS certificates. Not used
-# until prod-deploy plumbing exists; kept under version control so the
-# dev/prod surface stays symmetric.
+# Production placeholder. Single-origin, path-based — mirrors
+# `Caddyfile.dev` but binds the real public host and lets Caddy
+# auto-provision TLS. Not used until prod-deploy plumbing exists; kept
+# in version control so the dev/prod surface stays identical.
+#
+# The host is supplied at deploy time via `GALAXY_PUBLIC_HOST` so the
+# same image is domain-agnostic (the fallback is only a placeholder).
 
-www.galaxy.com {
-    root * /srv/galaxy-ui
+{$GALAXY_PUBLIC_HOST:galaxy.example} {
+	handle_path /rpc/* {
+		reverse_proxy galaxy-api:9090
+	}
 
-    # Mirrors the cache policy `Caddyfile.dev` documents in detail:
-    # SvelteKit's hash-named `_app/immutable/*` is safe to cache
-    # forever; everything else must revalidate so a deploy reaches
-    # the browser without a manual cache clear.
-    @immutable path /_app/immutable/*
-    header @immutable Cache-Control "public, max-age=31536000, immutable"
-    @dynamic not path /_app/immutable/*
-    header @dynamic Cache-Control "no-cache, must-revalidate"
+	@api path /api/* /healthz
+	handle @api {
+		reverse_proxy galaxy-api:8080
+	}
 
-    try_files {path} /index.html
-    file_server
-    encode zstd gzip
-}
-
-api.galaxy.com {
-    reverse_proxy galaxy-api:8080
+	handle /game {
+		redir * /game/ 308
+	}
+
+	handle_path /game/* {
+		root * /srv/galaxy-ui
+		@immutable path /_app/immutable/*
+		header @immutable Cache-Control "public, max-age=31536000, immutable"
+		@dynamic not path /_app/immutable/*
+		header @dynamic Cache-Control "no-cache, must-revalidate"
+		try_files {path} /index.html
+		file_server
+		encode zstd gzip
+	}
+
+	handle {
+		root * /srv/galaxy-site
+		@immutable path /assets/*
+		header @immutable Cache-Control "public, max-age=31536000, immutable"
+		@dynamic not path /assets/*
+		header @dynamic Cache-Control "no-cache, must-revalidate"
+		try_files {path} {path}.html {path}/index.html /404.html
+		file_server
+		encode zstd gzip
+	}
 }