feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/dev-deploy/docker-compose.yml

@@ -186,11 +186,14 @@ services:
       GATEWAY_RESPONSE_SIGNER_PRIVATE_KEY_PEM_PATH: /run/secrets/gateway-response.pem
       GATEWAY_REDIS_MASTER_ADDR: "galaxy-redis:6379"
       GATEWAY_REDIS_PASSWORD: galaxy-dev
-      # UI lives on https://www.galaxy.lan; the API is on
-      # https://api.galaxy.lan. Browsers therefore issue cross-origin
-      # requests to the gateway and need an explicit allow-list.
-      GATEWAY_PUBLIC_HTTP_CORS_ALLOWED_ORIGINS: "https://www.galaxy.lan"
-      GATEWAY_AUTHENTICATED_GRPC_CORS_ALLOWED_ORIGINS: "https://www.galaxy.lan"
+      # Single-origin deployment: the UI, public REST, and Connect-Web
+      # edge share one host, so browser requests are same-origin and
+      # CORS is not needed. An empty allow-list disables the CORS
+      # middleware (requests pass through without Access-Control-*
+      # headers). Re-populate these only if a future deploy fronts the
+      # gateway on a different host than the UI.
+      GATEWAY_PUBLIC_HTTP_CORS_ALLOWED_ORIGINS: ""
+      GATEWAY_AUTHENTICATED_GRPC_CORS_ALLOWED_ORIGINS: ""
       # Anti-abuse defaults are looser than production: the dev
       # environment is shared by a handful of trusted testers who
       # frequently hammer the same identity to reproduce flows.
@@ -237,6 +240,7 @@ services:
       - ./Caddyfile.dev:/etc/caddy/Caddyfile:ro
       - galaxy-dev-caddy-data:/data
       - galaxy-dev-ui-dist:/srv/galaxy-ui:ro
+      - galaxy-dev-site-dist:/srv/galaxy-site:ro
     networks:
       - galaxy-internal
       - edge
@@ -266,5 +270,7 @@ volumes:
     name: galaxy-dev-caddy-data
   galaxy-dev-ui-dist:
     name: galaxy-dev-ui-dist
+  galaxy-dev-site-dist:
+    name: galaxy-dev-site-dist
   galaxy-dev-geoip-data:
     name: galaxy-dev-geoip-data