feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/frontend/src/lib/env.ts

@@ -3,9 +3,14 @@
 // at the first import.
 //
 // `VITE_GATEWAY_BASE_URL` is the base URL of the gateway public REST
-// surface and the Connect-Web authenticated edge (same host, same
-// port; the gateway listener serves both). It defaults to the local
-// dev address used by `tools/local-ci` and the integration suite.
+// surface. An empty value means "same origin": the single-origin
+// deployment serves the UI, the REST surface (`/api/...`), and the
+// authenticated Connect-Web edge (`/rpc/...`) behind one host, so the
+// browser issues same-origin requests and needs no absolute base. A
+// non-empty value (the Vite dev proxy, `tools/local-ci`, the
+// integration suite) points REST at that absolute host instead. The
+// Connect base is derived from this value by `gatewayRpcBaseUrl`,
+// which appends the `/rpc` routing prefix.
 //
 // `VITE_GATEWAY_RESPONSE_PUBLIC_KEY` is the gateway's response-signing
 // Ed25519 public key, encoded as standard (non-URL-safe) base64 of
@@ -26,6 +31,21 @@ const RAW_RESPONSE_PUBLIC_KEY: string =
 
 export const GATEWAY_BASE_URL: string = stripTrailingSlash(RAW_BASE_URL);
 
+/**
+ * gatewayRpcBaseUrl is the base URL for the authenticated Connect-Web
+ * surface. The edge Caddy and the Vite dev proxy route the `/rpc`
+ * prefix to the gateway's Connect listener, stripping it before the
+ * request reaches the proto-derived `edge.v1.Gateway` service path.
+ * When `GATEWAY_BASE_URL` is empty the gateway shares the document
+ * origin, so the origin is resolved at call time from `window`.
+ */
+export function gatewayRpcBaseUrl(): string {
+	const origin =
+		GATEWAY_BASE_URL ||
+		(typeof window !== "undefined" ? window.location.origin : "");
+	return `${origin}/rpc`;
+}
+
 export const GATEWAY_RESPONSE_PUBLIC_KEY: Uint8Array = decodeBase64(
 	RAW_RESPONSE_PUBLIC_KEY,
 );