phase 5: wasm core, GalaxyClient skeleton, Connect-Web stubs

Compile `ui/core` to WebAssembly via TinyGo (903 KB) and expose four
canonical-bytes / signature-verification functions on
`globalThis.galaxyCore` from `ui/wasm/main.go`. The TypeScript-side
`Core` interface plus a `WasmCore` adapter (browser + JSDOM loader)
bridge those into a typed shape, and a `GalaxyClient` skeleton wires
`Core.signRequest` → injected `Signer` → typed Connect client →
`Core.verifyPayloadHash` / `verifyResponse`.

Wire `ui/buf.gen.yaml` against the local
`@bufbuild/protoc-gen-es` v2 binary (devDependency) so the codegen
step does not depend on the buf.build BSR. Vitest covers the bridge
end-to-end: per-method WasmCore tests under JSDOM, byte-for-byte
canon parity against the gateway fixtures committed in Phase 3, and
a `GalaxyClient` orchestration test using
`createRouterTransport`. The committed `core.wasm` snapshot tracks
TinyGo output so contributors run `make wasm` only when `ui/core/`
changes; CI consumes the snapshot directly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/frontend/src/api/connect.ts

@@ -0,0 +1,20 @@
+// `createEdgeGatewayClient` builds a typed Connect-Web client for the
+// gateway's authenticated edge surface. It speaks the Connect protocol
+// over HTTP/1.1 (or HTTP/2 if the host upgrades the connection) — the
+// gateway listener built in Phase 4 natively serves Connect, gRPC, and
+// gRPC-Web on the same h2c port.
+//
+// The factory is intentionally thin: callers provide the gateway base
+// URL (e.g. https://api.galaxy.test), and receive a typed
+// `EdgeGatewayClient`. Authentication, signing, and response
+// verification live one layer up, in `GalaxyClient`.
+
+import { createClient, type Client } from "@connectrpc/connect";
+import { createConnectTransport } from "@connectrpc/connect-web";
+import { EdgeGateway } from "../proto/galaxy/gateway/v1/edge_gateway_pb";
+
+export type EdgeGatewayClient = Client<typeof EdgeGateway>;
+
+export function createEdgeGatewayClient(baseUrl: string): EdgeGatewayClient {
+	return createClient(EdgeGateway, createConnectTransport({ baseUrl }));
+}