feat(admin): online dictionary update — upload archive, preview word diff, install & activate

Replace the dictionary hot-reload with an online update flow in the GM console
(/_gm/dictionary): the operator uploads scrabble-dawg-vX.Y.Z.tar.gz, previews the
per-variant words added/removed against the active dictionary, and confirms to
install + activate it. Versions are immutable; in-progress games keep their pinned
version while new games use the new one.

- engine: DiffWords (enumerate both DAWGs, decode only the differences), OpenFinder,
  Registry.Finder, DictFiles; OpenWithVersions skips the .staging area.
- dictadmin: hardened release-archive validation + extraction (path-traversal,
  symlink, oversize, entry-count rejection) and staging -> install (atomic rename).
- game: active dictionary version persisted in the dictionary_state singleton
  (single source of truth, restored on boot), concurrency-safe accessor.
- storage: BACKEND_DICT_DIR is a named volume seeded from the image (nonroot-owned),
  so uploaded versions persist across redeploys; the build's DICT_VERSION labels the
  seed and equals the resident tag (BACKEND_DICT_VERSION).
- docs: ARCHITECTURE §5, FUNCTIONAL (+ru), backend README, TESTING, PRERELEASE.

Tests: engine + dictadmin unit; integration upload->preview->install->activate->
restart->pin->immutability->CSRF.

backend/internal/postgres/migrations/00001_baseline.sql

@@ -158,7 +158,7 @@ CREATE TABLE game_moves (
 -- Word-check complaints captured in the context of a game's pinned dictionary. The
 -- admin review queue resolves them with a disposition that also feeds the offline
 -- dictionary-rebuild pipeline: an accepted complaint records whether the word is to be
--- added or removed, and is marked applied once a rebuilt version is hot-reloaded.
+-- added or removed, and is marked applied once a rebuilt version is installed.
 CREATE TABLE complaints (
     complaint_id       uuid        PRIMARY KEY,
     complainant_id     uuid        NOT NULL REFERENCES accounts (account_id),
@@ -180,6 +180,19 @@ CREATE TABLE complaints (
 );
 CREATE INDEX complaints_status_idx ON complaints (status);
 
+-- The active dictionary version new games pin, kept as the single source of truth
+-- so it survives a restart (the in-memory engine.Registry is rebuilt from the
+-- dictionary directory on every boot). A singleton row: id is always true. The
+-- admin dictionary-update flow sets active_version after it writes and loads a new
+-- version; new games read it, while in-flight games keep the version stamped on
+-- their games.dict_version (docs/ARCHITECTURE.md §5).
+CREATE TABLE dictionary_state (
+    id             boolean     PRIMARY KEY DEFAULT true,
+    active_version text        NOT NULL,
+    updated_at     timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT dictionary_state_singleton_chk CHECK (id)
+);
+
 -- Per-account lifetime statistics, recomputed incrementally on each game finish.
 -- Guests have no durable stats. A draw increments draws only. max_word_points is the
 -- best single move score (folding in every word the move formed and the all-tiles bonus).