feat(robot): per-game display names from a wide name corpus

Decouple the displayed opponent name from the small pool of durable robot
accounts: the disguised auto-match robot now gets a freshly composed name each
game, stamped on a new game_players.display_name seat snapshot. The snapshot
also captures humans' names, freezing what an opponent sees for the life of a
game (a later rename no longer rewrites past games); readers fall back to the
account's current name for pre-migration rows.

Names come from a wide composed corpus (internal/robot/namevariety.go): Western
locales (EN/DE/ES/IT/FR/PT), native Japanese/Chinese names, a gender-agreed
Russian pool, and human-style handles. Routing keeps Pick's spirit -- a Russian
game draws Cyrillic + <=20% Latin and never a CJK script; an English game the
full corpus -- via robot.PickNamed.

Loosen account.ValidateDisplayName (and the UI mirror) to admit a trailing run
of up to five digits, so "Player2007"-style handles are valid for humans too
and the disguised robot stays indistinguishable.

Migration 00007 adds game_players.display_name (additive, NOT NULL DEFAULT '');
jet regenerated. Docs (ARCHITECTURE 7, FUNCTIONAL + _ru, PLAN, README) updated.

backend/internal/inttest/open_match_test.go

@@ -161,11 +161,11 @@ func TestOpenGameResignRejectedUntilOpponent(t *testing.T) {
 		t.Fatalf("resign while open = %v, want ErrNoOpponentYet", err)
 	}
 
-	robotID, err := robots.Pick(engine.VariantEnglish)
+	robotID, name, err := robots.PickNamed(engine.VariantEnglish)
 	if err != nil {
 		t.Fatalf("pick: %v", err)
 	}
-	if _, attached, err := svc.AttachRobot(ctx, g.ID, robotID); err != nil || !attached {
+	if _, attached, err := svc.AttachRobot(ctx, g.ID, robotID, name); err != nil || !attached {
 		t.Fatalf("attach robot = (attached %v, err %v), want attached", attached, err)
 	}
 	res, err := svc.Resign(ctx, g.ID, starter)

backend/internal/inttest/seat_display_name_test.go

@@ -0,0 +1,102 @@
+//go:build integration
+
+package inttest
+
+import (
+	"context"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"scrabble/backend/internal/account"
+	"scrabble/backend/internal/engine"
+	"scrabble/backend/internal/game"
+)
+
+// The seat display-name snapshot freezes the name an opponent sees for the life of a
+// game (a later rename no longer rewrites past games) and lets a disguised robot carry a
+// fresh per-game name (docs/ARCHITECTURE.md §7).
+
+// seatByAccount returns the seat held by id and whether it was found.
+func seatByAccount(g game.Game, id uuid.UUID) (game.Seat, bool) {
+	for _, s := range g.Seats {
+		if s.AccountID == id {
+			return s, true
+		}
+	}
+	return game.Seat{}, false
+}
+
+// TestSeatNameFrozenAfterRename checks a human seat captures the player's display name
+// when the seat is taken and keeps it after the account is later renamed.
+func TestSeatNameFrozenAfterRename(t *testing.T) {
+	ctx := context.Background()
+	clearOpenGames(t)
+	svc := newGameService()
+	accounts := account.NewStore(testDB)
+
+	starter := provisionAccount(t)
+	if _, err := accounts.UpdateProfile(ctx, starter, account.ProfileUpdate{
+		DisplayName: "Original Name", PreferredLanguage: "en", TimeZone: "UTC",
+	}); err != nil {
+		t.Fatalf("set name: %v", err)
+	}
+
+	g := openGame(t, svc, starter, evenOpeningSeed(t))
+	seat, ok := seatByAccount(g, starter)
+	if !ok || seat.DisplayName != "Original Name" {
+		t.Fatalf("opened seat snapshot = %q (found %v), want %q", seat.DisplayName, ok, "Original Name")
+	}
+
+	// Rename the account; the snapshot on the already-taken seat must not follow.
+	if _, err := accounts.UpdateProfile(ctx, starter, account.ProfileUpdate{
+		DisplayName: "Renamed Player99", PreferredLanguage: "en", TimeZone: "UTC",
+	}); err != nil {
+		t.Fatalf("rename: %v", err)
+	}
+	reloaded, err := svc.GameByID(ctx, g.ID)
+	if err != nil {
+		t.Fatalf("reload game: %v", err)
+	}
+	got, _ := seatByAccount(reloaded, starter)
+	if got.DisplayName != "Original Name" {
+		t.Errorf("seat snapshot after rename = %q, want it frozen at %q", got.DisplayName, "Original Name")
+	}
+}
+
+// TestRobotSeatGetsComposedName checks the disguised auto-match robot's seat stores the
+// fresh per-game name composed at attach time (PickNamed -> AttachRobot -> seat), and
+// that the name is a valid human display name so the robot stays indistinguishable.
+func TestRobotSeatGetsComposedName(t *testing.T) {
+	ctx := context.Background()
+	clearOpenGames(t)
+	svc := newGameService()
+	robots := newRobotService(t, svc)
+	if err := robots.EnsurePool(ctx); err != nil {
+		t.Fatalf("ensure pool: %v", err)
+	}
+
+	g := openGame(t, svc, provisionAccount(t), evenOpeningSeed(t))
+	robotID, name, err := robots.PickNamed(engine.VariantEnglish)
+	if err != nil {
+		t.Fatalf("pick named: %v", err)
+	}
+	if _, err := account.ValidateDisplayName(name); err != nil {
+		t.Fatalf("composed robot name %q is not a valid display name: %v", name, err)
+	}
+	if _, attached, err := svc.AttachRobot(ctx, g.ID, robotID, name); err != nil || !attached {
+		t.Fatalf("attach robot = (attached %v, err %v), want attached", attached, err)
+	}
+
+	reloaded, err := svc.GameByID(ctx, g.ID)
+	if err != nil {
+		t.Fatalf("reload game: %v", err)
+	}
+	seat, ok := seatByAccount(reloaded, robotID)
+	if !ok {
+		t.Fatal("robot seat not found after attach")
+	}
+	if seat.DisplayName != name {
+		t.Errorf("robot seat snapshot = %q, want the composed per-game name %q", seat.DisplayName, name)
+	}
+}