feat(admin): online dictionary update — upload archive, preview word diff, install & activate

Replace the dictionary hot-reload with an online update flow in the GM console
(/_gm/dictionary): the operator uploads scrabble-dawg-vX.Y.Z.tar.gz, previews the
per-variant words added/removed against the active dictionary, and confirms to
install + activate it. Versions are immutable; in-progress games keep their pinned
version while new games use the new one.

- engine: DiffWords (enumerate both DAWGs, decode only the differences), OpenFinder,
  Registry.Finder, DictFiles; OpenWithVersions skips the .staging area.
- dictadmin: hardened release-archive validation + extraction (path-traversal,
  symlink, oversize, entry-count rejection) and staging -> install (atomic rename).
- game: active dictionary version persisted in the dictionary_state singleton
  (single source of truth, restored on boot), concurrency-safe accessor.
- storage: BACKEND_DICT_DIR is a named volume seeded from the image (nonroot-owned),
  so uploaded versions persist across redeploys; the build's DICT_VERSION labels the
  seed and equals the resident tag (BACKEND_DICT_VERSION).
- docs: ARCHITECTURE §5, FUNCTIONAL (+ru), backend README, TESTING, PRERELEASE.

Tests: engine + dictadmin unit; integration upload->preview->install->activate->
restart->pin->immutability->CSRF.

backend/internal/postgres/jet/backend/model/dictionary_state.go

@@ -0,0 +1,18 @@
+//
+// Code generated by go-jet DO NOT EDIT.
+//
+// WARNING: Changes to this file may cause incorrect behavior
+// and will be lost if the code is regenerated
+//
+
+package model
+
+import (
+	"time"
+)
+
+type DictionaryState struct {
+	ID            bool `sql:"primary_key"`
+	ActiveVersion string
+	UpdatedAt     time.Time
+}

backend/internal/postgres/jet/backend/table/dictionary_state.go

@@ -0,0 +1,84 @@
+//
+// Code generated by go-jet DO NOT EDIT.
+//
+// WARNING: Changes to this file may cause incorrect behavior
+// and will be lost if the code is regenerated
+//
+
+package table
+
+import (
+	"github.com/go-jet/jet/v2/postgres"
+)
+
+var DictionaryState = newDictionaryStateTable("backend", "dictionary_state", "")
+
+type dictionaryStateTable struct {
+	postgres.Table
+
+	// Columns
+	ID            postgres.ColumnBool
+	ActiveVersion postgres.ColumnString
+	UpdatedAt     postgres.ColumnTimestampz
+
+	AllColumns     postgres.ColumnList
+	MutableColumns postgres.ColumnList
+	DefaultColumns postgres.ColumnList
+}
+
+type DictionaryStateTable struct {
+	dictionaryStateTable
+
+	EXCLUDED dictionaryStateTable
+}
+
+// AS creates new DictionaryStateTable with assigned alias
+func (a DictionaryStateTable) AS(alias string) *DictionaryStateTable {
+	return newDictionaryStateTable(a.SchemaName(), a.TableName(), alias)
+}
+
+// Schema creates new DictionaryStateTable with assigned schema name
+func (a DictionaryStateTable) FromSchema(schemaName string) *DictionaryStateTable {
+	return newDictionaryStateTable(schemaName, a.TableName(), a.Alias())
+}
+
+// WithPrefix creates new DictionaryStateTable with assigned table prefix
+func (a DictionaryStateTable) WithPrefix(prefix string) *DictionaryStateTable {
+	return newDictionaryStateTable(a.SchemaName(), prefix+a.TableName(), a.TableName())
+}
+
+// WithSuffix creates new DictionaryStateTable with assigned table suffix
+func (a DictionaryStateTable) WithSuffix(suffix string) *DictionaryStateTable {
+	return newDictionaryStateTable(a.SchemaName(), a.TableName()+suffix, a.TableName())
+}
+
+func newDictionaryStateTable(schemaName, tableName, alias string) *DictionaryStateTable {
+	return &DictionaryStateTable{
+		dictionaryStateTable: newDictionaryStateTableImpl(schemaName, tableName, alias),
+		EXCLUDED:             newDictionaryStateTableImpl("", "excluded", ""),
+	}
+}
+
+func newDictionaryStateTableImpl(schemaName, tableName, alias string) dictionaryStateTable {
+	var (
+		IDColumn            = postgres.BoolColumn("id")
+		ActiveVersionColumn = postgres.StringColumn("active_version")
+		UpdatedAtColumn     = postgres.TimestampzColumn("updated_at")
+		allColumns          = postgres.ColumnList{IDColumn, ActiveVersionColumn, UpdatedAtColumn}
+		mutableColumns      = postgres.ColumnList{ActiveVersionColumn, UpdatedAtColumn}
+		defaultColumns      = postgres.ColumnList{IDColumn, UpdatedAtColumn}
+	)
+
+	return dictionaryStateTable{
+		Table: postgres.NewTable(schemaName, tableName, alias, allColumns...),
+
+		//Columns
+		ID:            IDColumn,
+		ActiveVersion: ActiveVersionColumn,
+		UpdatedAt:     UpdatedAtColumn,
+
+		AllColumns:     allColumns,
+		MutableColumns: mutableColumns,
+		DefaultColumns: defaultColumns,
+	}
+}

backend/internal/postgres/jet/backend/table/table_use_schema.go

@@ -15,6 +15,7 @@ func UseSchema(schema string) {
 	Blocks = Blocks.FromSchema(schema)
 	ChatMessages = ChatMessages.FromSchema(schema)
 	Complaints = Complaints.FromSchema(schema)
+	DictionaryState = DictionaryState.FromSchema(schema)
 	EmailConfirmations = EmailConfirmations.FromSchema(schema)
 	FriendCodes = FriendCodes.FromSchema(schema)
 	Friendships = Friendships.FromSchema(schema)