feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/frontend/src/api/connect.ts

@@ -1,20 +1,21 @@
-// `createEdgeGatewayClient` builds a typed Connect-Web client for the
+// `createGatewayClient` builds a typed Connect-Web client for the
 // gateway's authenticated edge surface. It speaks the Connect protocol
 // over HTTP/1.1 (or HTTP/2 if the host upgrades the connection) — the
 // gateway listener built in Phase 4 natively serves Connect, gRPC, and
 // gRPC-Web on the same h2c port.
 //
-// The factory is intentionally thin: callers provide the gateway base
-// URL (e.g. https://api.galaxy.test), and receive a typed
-// `EdgeGatewayClient`. Authentication, signing, and response
+// The factory is intentionally thin: callers provide the Connect base
+// URL (the same-origin `/rpc` prefix from `gatewayRpcBaseUrl`), and
+// receive a typed
+// `GatewayClient`. Authentication, signing, and response
 // verification live one layer up, in `GalaxyClient`.
 
 import { createClient, type Client } from "@connectrpc/connect";
 import { createConnectTransport } from "@connectrpc/connect-web";
-import { EdgeGateway } from "../proto/galaxy/gateway/v1/edge_gateway_pb";
+import { Gateway } from "../proto/edge/v1/edge_gateway_pb";
 
-export type EdgeGatewayClient = Client<typeof EdgeGateway>;
+export type GatewayClient = Client<typeof Gateway>;
 
-export function createEdgeGatewayClient(baseUrl: string): EdgeGatewayClient {
-	return createClient(EdgeGateway, createConnectTransport({ baseUrl }));
+export function createGatewayClient(baseUrl: string): GatewayClient {
+	return createClient(Gateway, createConnectTransport({ baseUrl }));
 }

ui/frontend/src/api/events.svelte.ts

@@ -26,10 +26,10 @@ import type { DeviceKeypair } from "../platform/store/index";
 import {
 	SubscribeEventsRequestSchema,
 	type GatewayEvent,
-} from "../proto/galaxy/gateway/v1/edge_gateway_pb";
-import { GATEWAY_BASE_URL } from "../lib/env";
+} from "../proto/edge/v1/edge_gateway_pb";
+import { gatewayRpcBaseUrl } from "../lib/env";
 import { session } from "../lib/session-store.svelte";
-import { createEdgeGatewayClient, type EdgeGatewayClient } from "./connect";
+import { createGatewayClient, type GatewayClient } from "./connect";
 
 const PROTOCOL_VERSION = "v1";
 const SUBSCRIBE_MESSAGE_TYPE = "gateway.subscribe";
@@ -83,7 +83,7 @@ export type ConnectionStatus =
  * consumer cannot resolve by itself. Production code reads `core`,
  * `keypair`, and `deviceSessionId` from the session store and the
  * gateway public key from `lib/env`; tests inject a fake
- * `EdgeGatewayClient` and deterministic `sleep`/`random` to drive
+ * `GatewayClient` and deterministic `sleep`/`random` to drive
  * backoff in fake-timer mode.
  */
 export interface EventStreamStartOptions {
@@ -91,8 +91,8 @@ export interface EventStreamStartOptions {
 	keypair: DeviceKeypair;
 	deviceSessionId: string;
 	gatewayResponsePublicKey: Uint8Array;
-	/** Custom transport client. Defaults to `createEdgeGatewayClient(GATEWAY_BASE_URL)`. */
-	client?: EdgeGatewayClient;
+	/** Custom transport client. Defaults to `createGatewayClient(gatewayRpcBaseUrl())`. */
+	client?: GatewayClient;
 	/** Sleep hook for tests; defaults to a real-time `setTimeout`. */
 	sleep?: (ms: number) => Promise<void>;
 	/** Random source for full-jitter backoff; defaults to `Math.random`. */
@@ -189,7 +189,7 @@ export class EventStream {
 		const sleep = opts.sleep ?? defaultSleep;
 		const random = opts.random ?? Math.random;
 		const onlineProbe = opts.onlineProbe ?? defaultOnlineProbe;
-		const client = opts.client ?? createEdgeGatewayClient(GATEWAY_BASE_URL);
+		const client = opts.client ?? createGatewayClient(gatewayRpcBaseUrl());
 
 		let attempt = 0;
 		while (!signal.aborted && this.running) {
@@ -311,7 +311,7 @@ export class EventStream {
 }
 
 async function openStream(
-	client: EdgeGatewayClient,
+	client: GatewayClient,
 	opts: EventStreamStartOptions,
 	signal: AbortSignal,
 ): Promise<AsyncIterable<GatewayEvent>> {

ui/frontend/src/api/galaxy-client.ts

@@ -15,8 +15,8 @@ import type { Core } from "../platform/core/index";
 import {
 	ExecuteCommandRequestSchema,
 	type ExecuteCommandResponse,
-} from "../proto/galaxy/gateway/v1/edge_gateway_pb";
-import type { EdgeGatewayClient } from "./connect";
+} from "../proto/edge/v1/edge_gateway_pb";
+import type { GatewayClient } from "./connect";
 
 /**
  * Signer produces a raw 64-byte Ed25519 signature over canonicalBytes.
@@ -35,7 +35,7 @@ export type Sha256 = (payload: Uint8Array) => Promise<Uint8Array>;
 
 export interface GalaxyClientOptions {
 	core: Core;
-	edge: EdgeGatewayClient;
+	edge: GatewayClient;
 	signer: Signer;
 	sha256: Sha256;
 	deviceSessionId: string;
@@ -53,7 +53,7 @@ export interface ExecuteCommandResult {
 
 export class GalaxyClient {
 	private readonly core: Core;
-	private readonly edge: EdgeGatewayClient;
+	private readonly edge: GatewayClient;
 	private readonly signer: Signer;
 	private readonly sha256: Sha256;
 	private readonly deviceSessionId: string;