feat(admin): online dictionary update — upload archive, preview word diff, install & activate

Replace the dictionary hot-reload with an online update flow in the GM console
(/_gm/dictionary): the operator uploads scrabble-dawg-vX.Y.Z.tar.gz, previews the
per-variant words added/removed against the active dictionary, and confirms to
install + activate it. Versions are immutable; in-progress games keep their pinned
version while new games use the new one.

- engine: DiffWords (enumerate both DAWGs, decode only the differences), OpenFinder,
  Registry.Finder, DictFiles; OpenWithVersions skips the .staging area.
- dictadmin: hardened release-archive validation + extraction (path-traversal,
  symlink, oversize, entry-count rejection) and staging -> install (atomic rename).
- game: active dictionary version persisted in the dictionary_state singleton
  (single source of truth, restored on boot), concurrency-safe accessor.
- storage: BACKEND_DICT_DIR is a named volume seeded from the image (nonroot-owned),
  so uploaded versions persist across redeploys; the build's DICT_VERSION labels the
  seed and equals the resident tag (BACKEND_DICT_VERSION).
- docs: ARCHITECTURE §5, FUNCTIONAL (+ru), backend README, TESTING, PRERELEASE.

Tests: engine + dictadmin unit; integration upload->preview->install->activate->
restart->pin->immutability->CSRF.

docs/FUNCTIONAL.md

@@ -183,10 +183,13 @@ renders it; the gateway gates it with HTTP Basic Auth on its public listener and
 proxies it verbatim. The console lists and inspects **users** (profile, statistics,
 identities, their games) and **games** (summary + seats), works the **word-complaint
 review queue** — resolving each as reject / accept-add / accept-remove — and exposes
-the **dictionary**: the resident versions per variant, a **hot-reload** of a new
-version from `BACKEND_DICT_DIR/<version>/`, and the **pending wordlist changes**
-derived from accepted complaints (which feed the offline rebuild and are marked
-applied after a reload). When a Telegram connector is configured an operator can also
+the **dictionary**: the active version new games pin, the resident versions per
+variant, an online **dictionary update** (upload the `scrabble-dawg-vX.Y.Z.tar.gz`
+release archive, preview the words added and removed per variant against the active
+dictionary, then install — which writes the version, loads it and makes it active;
+versions are immutable and games in progress keep their own), and the **pending
+wordlist changes** derived from accepted complaints (which feed the offline rebuild
+and are marked applied after an update). When a Telegram connector is configured an operator can also
 **message a user** (by their Telegram identity) or **post to the game channel**.
 State-changing actions are protected by a same-origin check; the console tracks no
 operator identity.