feat(deploy): single-origin path-based deployment + project site

Serve the whole stack behind one host: site at /, game UI at /game/,
gateway REST at /api + /healthz, Connect at /rpc (prefix stripped by the
edge Caddy). The built artifact is domain-agnostic — the UI talks to the
gateway same-origin via relative URLs, so the same bundle runs under any
host with no rebuild and with CORS disabled.

- Rename the Connect proto service galaxy.gateway.v1.EdgeGateway ->
  edge.v1.Gateway; regenerate Go + TS; public path /rpc/edge.v1.Gateway.
- Move the game UI under base path /game (env BASE_PATH); make the
  manifest, service-worker scope, WASM loader, and all navigation
  base-aware via a withBase helper.
- Relative API + /rpc Connect prefix; Vite dev proxy mirrors the strip.
- Rewrite the edge Caddy (dev + prod) for path-based routing; empty CORS
  allow-lists (same-origin); single host.
- New VitePress project site (site/): i18n en/ru with switcher, LaTeX
  math, minimal monospace theme; built and served at /.
- dev-deploy compose/Makefile + CI (dev-deploy, prod-build, new
  site-build) build and seed the site; probes hit /, /game/, /healthz.
- Sync docs (ARCHITECTURE, gateway README/openapi, dev-deploy &
  local-dev READMEs, CLAUDE.md, ui/PLAN).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/frontend/tests/e2e/auth-flow.spec.ts

@@ -8,13 +8,13 @@
 // server picks up via `VITE_GATEWAY_RESPONSE_PUBLIC_KEY`.
 //
 // The Connect-Web request URL pattern is
-//   <baseUrl>/galaxy.gateway.v1.EdgeGateway/<MethodName>
+//   <baseUrl>/edge.v1.Gateway/<MethodName>
 // so the route handlers below match against the trailing path
 // suffix and ignore the host.
 
 import { fromJson, type JsonValue } from "@bufbuild/protobuf";
 import { expect, test, type Page } from "@playwright/test";
-import { ExecuteCommandRequestSchema } from "../../src/proto/galaxy/gateway/v1/edge_gateway_pb";
+import { ExecuteCommandRequestSchema } from "../../src/proto/edge/v1/edge_gateway_pb";
 import { forgeExecuteCommandResponseJson } from "./fixtures/sign-response";
 import {
 	buildAccountResponsePayload,
@@ -54,7 +54,7 @@ async function mockGatewayHappyPath(
 	);
 
 	await page.route(
-		"**/galaxy.gateway.v1.EdgeGateway/ExecuteCommand",
+		"**/edge.v1.Gateway/ExecuteCommand",
 		async (route) => {
 			const reqText = route.request().postData();
 			if (reqText === null) {
@@ -105,7 +105,7 @@ async function mockGatewayHappyPath(
 	);
 
 	await page.route(
-		"**/galaxy.gateway.v1.EdgeGateway/SubscribeEvents",
+		"**/edge.v1.Gateway/SubscribeEvents",
 		async (route) => {
 			// Hold the stream open until the test releases it via
 			// `pendingSubscribes`. Releasing fulfils with a Connect