feat(admin): online dictionary update — upload archive, preview word diff, install & activate

Replace the dictionary hot-reload with an online update flow in the GM console
(/_gm/dictionary): the operator uploads scrabble-dawg-vX.Y.Z.tar.gz, previews the
per-variant words added/removed against the active dictionary, and confirms to
install + activate it. Versions are immutable; in-progress games keep their pinned
version while new games use the new one.

- engine: DiffWords (enumerate both DAWGs, decode only the differences), OpenFinder,
  Registry.Finder, DictFiles; OpenWithVersions skips the .staging area.
- dictadmin: hardened release-archive validation + extraction (path-traversal,
  symlink, oversize, entry-count rejection) and staging -> install (atomic rename).
- game: active dictionary version persisted in the dictionary_state singleton
  (single source of truth, restored on boot), concurrency-safe accessor.
- storage: BACKEND_DICT_DIR is a named volume seeded from the image (nonroot-owned),
  so uploaded versions persist across redeploys; the build's DICT_VERSION labels the
  seed and equals the resident tag (BACKEND_DICT_VERSION).
- docs: ARCHITECTURE §5, FUNCTIONAL (+ru), backend README, TESTING, PRERELEASE.

Tests: engine + dictadmin unit; integration upload->preview->install->activate->
restart->pin->immutability->CSRF.

backend/internal/postgres/jet/backend/model/dictionary_state.go

@@ -0,0 +1,18 @@
+//
+// Code generated by go-jet DO NOT EDIT.
+//
+// WARNING: Changes to this file may cause incorrect behavior
+// and will be lost if the code is regenerated
+//
+
+package model
+
+import (
+	"time"
+)
+
+type DictionaryState struct {
+	ID            bool `sql:"primary_key"`
+	ActiveVersion string
+	UpdatedAt     time.Time
+}

backend/internal/postgres/jet/backend/table/dictionary_state.go

@@ -0,0 +1,84 @@
+//
+// Code generated by go-jet DO NOT EDIT.
+//
+// WARNING: Changes to this file may cause incorrect behavior
+// and will be lost if the code is regenerated
+//
+
+package table
+
+import (
+	"github.com/go-jet/jet/v2/postgres"
+)
+
+var DictionaryState = newDictionaryStateTable("backend", "dictionary_state", "")
+
+type dictionaryStateTable struct {
+	postgres.Table
+
+	// Columns
+	ID            postgres.ColumnBool
+	ActiveVersion postgres.ColumnString
+	UpdatedAt     postgres.ColumnTimestampz
+
+	AllColumns     postgres.ColumnList
+	MutableColumns postgres.ColumnList
+	DefaultColumns postgres.ColumnList
+}
+
+type DictionaryStateTable struct {
+	dictionaryStateTable
+
+	EXCLUDED dictionaryStateTable
+}
+
+// AS creates new DictionaryStateTable with assigned alias
+func (a DictionaryStateTable) AS(alias string) *DictionaryStateTable {
+	return newDictionaryStateTable(a.SchemaName(), a.TableName(), alias)
+}
+
+// Schema creates new DictionaryStateTable with assigned schema name
+func (a DictionaryStateTable) FromSchema(schemaName string) *DictionaryStateTable {
+	return newDictionaryStateTable(schemaName, a.TableName(), a.Alias())
+}
+
+// WithPrefix creates new DictionaryStateTable with assigned table prefix
+func (a DictionaryStateTable) WithPrefix(prefix string) *DictionaryStateTable {
+	return newDictionaryStateTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
+}
+
+// WithSuffix creates new DictionaryStateTable with assigned table suffix
+func (a DictionaryStateTable) WithSuffix(suffix string) *DictionaryStateTable {
+	return newDictionaryStateTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
+}
+
+func newDictionaryStateTable(schemaName, tableName, alias string) *DictionaryStateTable {
+	return &DictionaryStateTable{
+		dictionaryStateTable: newDictionaryStateTableImpl(schemaName, tableName, alias),
+		EXCLUDED:             newDictionaryStateTableImpl("", "excluded", ""),
+	}
+}
+
+func newDictionaryStateTableImpl(schemaName, tableName, alias string) dictionaryStateTable {
+	var (
+		IDColumn            = postgres.BoolColumn("id")
+		ActiveVersionColumn = postgres.StringColumn("active_version")
+		UpdatedAtColumn     = postgres.TimestampzColumn("updated_at")
+		allColumns          = postgres.ColumnList{IDColumn, ActiveVersionColumn, UpdatedAtColumn}
+		mutableColumns      = postgres.ColumnList{ActiveVersionColumn, UpdatedAtColumn}
+		defaultColumns      = postgres.ColumnList{IDColumn, UpdatedAtColumn}
+	)
+
+	return dictionaryStateTable{
+		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
+
+		//Columns
+		ID:            IDColumn,
+		ActiveVersion: ActiveVersionColumn,
+		UpdatedAt:     UpdatedAtColumn,
+
+		AllColumns:     allColumns,
+		MutableColumns: mutableColumns,
+		DefaultColumns: defaultColumns,
+	}
+}

backend/internal/postgres/jet/backend/table/table_use_schema.go

@@ -15,6 +15,7 @@ func UseSchema(schema string) {
 	Blocks = Blocks.FromSchema(schema)
 	ChatMessages = ChatMessages.FromSchema(schema)
 	Complaints = Complaints.FromSchema(schema)
+	DictionaryState = DictionaryState.FromSchema(schema)
 	EmailConfirmations = EmailConfirmations.FromSchema(schema)
 	FriendCodes = FriendCodes.FromSchema(schema)
 	Friendships = Friendships.FromSchema(schema)

backend/internal/postgres/migrations/00001_baseline.sql

@@ -158,7 +158,7 @@ CREATE TABLE game_moves (
 -- Word-check complaints captured in the context of a game's pinned dictionary. The
 -- admin review queue resolves them with a disposition that also feeds the offline
 -- dictionary-rebuild pipeline: an accepted complaint records whether the word is to be
--- added or removed, and is marked applied once a rebuilt version is hot-reloaded.
+-- added or removed, and is marked applied once a rebuilt version is installed.
 CREATE TABLE complaints (
     complaint_id       uuid        PRIMARY KEY,
     complainant_id     uuid        NOT NULL REFERENCES accounts (account_id),
@@ -180,6 +180,19 @@ CREATE TABLE complaints (
 );
 CREATE INDEX complaints_status_idx ON complaints (status);
 
+-- The active dictionary version new games pin, kept as the single source of truth
+-- so it survives a restart (the in-memory engine.Registry is rebuilt from the
+-- dictionary directory on every boot). A singleton row: id is always true. The
+-- admin dictionary-update flow sets active_version after it writes and loads a new
+-- version; new games read it, while in-flight games keep the version stamped on
+-- their games.dict_version (docs/ARCHITECTURE.md §5).
+CREATE TABLE dictionary_state (
+    id             boolean     PRIMARY KEY DEFAULT true,
+    active_version text        NOT NULL,
+    updated_at     timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT dictionary_state_singleton_chk CHECK (id)
+);
+
 -- Per-account lifetime statistics, recomputed incrementally on each game finish.
 -- Guests have no durable stats. A draw increments draws only. max_word_points is the
 -- best single move score (folding in every word the move formed and the all-tiles bonus).