feat(gateway): temporary IP ban (fail2ban) fed by rejections + honeypot/honeytoken

Add a prod-only, in-memory IP ban enforced at the edge, fed by three signals:
sustained rate-limiter rejections (the IP-keyed public/email/admin classes — the
user class stays the backend soft-flag's concern), a honeypot decoy-path hit (the
contour caddy tags decoys with X-Scrabble-Honeypot and routes them to the gateway),
and a honeytoken (a planted bearer, GATEWAY_HONEYTOKEN). A banned IP is refused with
429 by the abuseGuard middleware before any work — covering the Connect edge, the
live stream and the static SPA/landing the per-op limiter never gated.

The ban is off by default: it keys by the real client IP the shared-NAT test contour
does not expose, so a ban there would be self-inflicted; detection still logs in the
contour, only the ban action is gated (GATEWAY_ABUSE_BAN_ENABLED). Rejection bans last
GATEWAY_ABUSE_BAN_DURATION; tripwire/honeytoken hits are near-zero-false-positive and
earn longer fixed bans. Each ban increments gateway_abuse_banned_total{reason}.

Operators see and lift active bans on the admin console's Throttled page; the gateway
syncs its active set to the backend every 30s (POST /api/v1/internal/bans/sync,
backend/internal/banview) and applies the operator unbans the response returns.

PRERELEASE phase AG. Docs baked into ARCHITECTURE / FUNCTIONAL (+ru) / both READMEs.

deploy/caddy/Caddyfile

@@ -38,10 +38,27 @@
 		}
 	}
 
-	# The game SPA and the Connect edge are served by the gateway.
+	# The game SPA and the Connect edge are served by the gateway. Strip any
+	# client-supplied X-Scrabble-Honeypot here so the gateway only ever honours the
+	# tag the honeypot block sets below (a client cannot self-tag a real request).
 	@gateway path /app /app/* /telegram /telegram/* /scrabble.edge.v1.Gateway/*
 	handle @gateway {
-		reverse_proxy gateway:8081
+		reverse_proxy gateway:8081 {
+			header_up -X-Scrabble-Honeypot
+		}
+	}
+
+	# Honeypot decoy paths: classic vulnerability-scanner bait no real client ever
+	# requests. Route them to the gateway tagged with X-Scrabble-Honeypot so it logs
+	# the scanner hit and (in prod) bans the source IP. The inbound header is
+	# stripped first so a client cannot pre-set it — and even if it did, it would
+	# only ban itself. Keep this list in sync with no legitimate landing/app path.
+	@honeypot path /.env /.git /.git/* /.aws/* /wp-login.php /wp-admin /wp-admin/* /phpmyadmin /phpmyadmin/*
+	handle @honeypot {
+		reverse_proxy gateway:8081 {
+			header_up -X-Scrabble-Honeypot
+			header_up X-Scrabble-Honeypot 1
+		}
 	}
 
 	# Everything else — the public landing at / and any stray path — is static.