feat(admin): online dictionary update — upload archive, preview word diff, install & activate

Replace the dictionary hot-reload with an online update flow in the GM console
(/_gm/dictionary): the operator uploads scrabble-dawg-vX.Y.Z.tar.gz, previews the
per-variant words added/removed against the active dictionary, and confirms to
install + activate it. Versions are immutable; in-progress games keep their pinned
version while new games use the new one.

- engine: DiffWords (enumerate both DAWGs, decode only the differences), OpenFinder,
  Registry.Finder, DictFiles; OpenWithVersions skips the .staging area.
- dictadmin: hardened release-archive validation + extraction (path-traversal,
  symlink, oversize, entry-count rejection) and staging -> install (atomic rename).
- game: active dictionary version persisted in the dictionary_state singleton
  (single source of truth, restored on boot), concurrency-safe accessor.
- storage: BACKEND_DICT_DIR is a named volume seeded from the image (nonroot-owned),
  so uploaded versions persist across redeploys; the build's DICT_VERSION labels the
  seed and equals the resident tag (BACKEND_DICT_VERSION).
- docs: ARCHITECTURE §5, FUNCTIONAL (+ru), backend README, TESTING, PRERELEASE.

Tests: engine + dictadmin unit; integration upload->preview->install->activate->
restart->pin->immutability->CSRF.

docs/TESTING.md

@@ -91,15 +91,20 @@ tests or touching CI.
   the profile-update away round-trip) and a `notify`-event constructor round-trip.
 - **Admin & dictionary ops** — `backend/internal/adminconsole` unit-tests
   the template renderer over every page plus the embedded asset; `backend/internal/engine`
-  adds the **dictionary hot-reload** cases (`LoadAvailable` loads only the present
-  variants, `OpenWithVersions` scans version subdirectories, a reload registers a new
-  version and moves "latest"); `backend/internal/server` unit-tests the console's
+  adds the **dictionary** cases (`LoadAvailable` loads only the present variants,
+  `OpenWithVersions` scans version subdirectories and skips the staging area, `DiffWords`
+  decodes the words added/removed between two versions); `backend/internal/dictadmin`
+  unit-tests the release-archive validation and hardened extraction (path-traversal,
+  symlink, oversize and entry-count rejection, immutable versions); `backend/internal/server` unit-tests the console's
   **same-origin** CSRF guard; the gateway adds the **verbatim `/_gm` Basic-Auth proxy**
   (401 / forward, path preserved) and the h2c **console mount** (routed when configured,
   404 when not). Postgres-backed `inttest` drives the **complaint resolution →
   dictionary-change pipeline** (file → resolve with a disposition → pending change → mark
-  applied), the admin **list/count** read queries, and the **/_gm console over HTTP**
-  (pages render; a resolve POST needs a same-origin header). `ratewatch` has
+  applied), the **dictionary update flow** (upload a release archive over HTTP → preview →
+  install → the new version becomes active and resident, persists across a restart, pins new
+  games while in-progress games keep theirs, and is immutable), the admin **list/count** read
+  queries, and the **/_gm console over HTTP** (pages render; a resolve POST needs a
+  same-origin header). `ratewatch` has
   unit tests (window accumulation, the auto-flag threshold + expiry, the bounded
   episode map), the account-store **high-rate flag round-trip** (set-once / clear /
   re-flag) and a console flow in `inttest`: a gateway report auto-flags the account,