feat(admin): online dictionary update — upload archive, preview word diff, install & activate

Replace the dictionary hot-reload with an online update flow in the GM console
(/_gm/dictionary): the operator uploads scrabble-dawg-vX.Y.Z.tar.gz, previews the
per-variant words added/removed against the active dictionary, and confirms to
install + activate it. Versions are immutable; in-progress games keep their pinned
version while new games use the new one.

- engine: DiffWords (enumerate both DAWGs, decode only the differences), OpenFinder,
  Registry.Finder, DictFiles; OpenWithVersions skips the .staging area.
- dictadmin: hardened release-archive validation + extraction (path-traversal,
  symlink, oversize, entry-count rejection) and staging -> install (atomic rename).
- game: active dictionary version persisted in the dictionary_state singleton
  (single source of truth, restored on boot), concurrency-safe accessor.
- storage: BACKEND_DICT_DIR is a named volume seeded from the image (nonroot-owned),
  so uploaded versions persist across redeploys; the build's DICT_VERSION labels the
  seed and equals the resident tag (BACKEND_DICT_VERSION).
- docs: ARCHITECTURE §5, FUNCTIONAL (+ru), backend README, TESTING, PRERELEASE.

Tests: engine + dictadmin unit; integration upload->preview->install->activate->
restart->pin->immutability->CSRF.

gateway/internal/connectsrv/server.go

@@ -149,9 +149,13 @@ func (s *Server) HTTPHandler() http.Handler {
 		// The admin console (backend /_gm) is served on the public listener behind
 		// the proxy's Basic-Auth, mounted below the h2c wrap so the Connect edge keeps
 		// working over h2c (docs/ARCHITECTURE.md §12). In the deployed contour the
-		// front caddy owns the /_gm Basic-Auth and Grafana routing; this mount serves
-		// a non-caddy (local) setup. The per-IP admin limiter class guards it —
-		// notably a Basic-Auth brute force.
+		// front caddy owns the /_gm Basic-Auth and Grafana routing and proxies /_gm to
+		// the backend directly (bypassing this mount); this mount serves a non-caddy
+		// (local) setup. The per-IP admin limiter class guards it — notably a Basic-Auth
+		// brute force. Note: the shared maxBodyHandler cap (1 MiB by default) also covers
+		// this mount, so a dictionary-archive upload through the gateway-fronted console
+		// needs a larger GATEWAY_MAX_BODY_BYTES; the contour path (caddy → backend) is not
+		// affected and the backend self-caps the upload.
 		mux.Handle("/_gm/", s.limitAdmin(s.adminProxy))
 	} else {
 		// With the console disabled here, keep /_gm a 404 so the SPA catch-all below