feat(robot): per-game display names from a wide name corpus

Decouple the displayed opponent name from the small pool of durable robot
accounts: the disguised auto-match robot now gets a freshly composed name each
game, stamped on a new game_players.display_name seat snapshot. The snapshot
also captures humans' names, freezing what an opponent sees for the life of a
game (a later rename no longer rewrites past games); readers fall back to the
account's current name for pre-migration rows.

Names come from a wide composed corpus (internal/robot/namevariety.go): Western
locales (EN/DE/ES/IT/FR/PT), native Japanese/Chinese names, a gender-agreed
Russian pool, and human-style handles. Routing keeps Pick's spirit -- a Russian
game draws Cyrillic + <=20% Latin and never a CJK script; an English game the
full corpus -- via robot.PickNamed.

Loosen account.ValidateDisplayName (and the UI mirror) to admit a trailing run
of up to five digits, so "Player2007"-style handles are valid for humans too
and the disguised robot stays indistinguishable.

Migration 00007 adds game_players.display_name (additive, NOT NULL DEFAULT '');
jet regenerated. Docs (ARCHITECTURE 7, FUNCTIONAL + _ru, PLAN, README) updated.

docs/ARCHITECTURE.md

@@ -392,13 +392,25 @@ replay. A pool of durable accounts — each a `kind='robot'` identity (§4), key
 `robot-<lang>-<index>` and provisioned at startup with **chat blocked but friend
 requests open** — a request to a robot is accepted as pending and expires unanswered
 (the robot never responds), mirroring a human who ignores it; the chat
-block backs the human-like names (there is no DM surface; chat is per-game). Names are
-**composed per language** from a first-name pool (32 full + 32 colloquial forms) and
-a surname pool (gender-agreed for Russian) in one of three forms (first only /
-first + surname initial / first + full surname), deterministically per pool slot so
-they stay stable across restarts. Substitution is **variant-aware**: a Russian game
-(Russian Scrabble or Эрудит) draws a Russian-named robot with at most ~20% Latin, an
-English game the Latin pool.
+block backs the human-like names (there is no DM surface; chat is per-game).
+
+**Per-game names.** A seated player's display name is **snapshotted on the seat**
+(`game_players.display_name`) when the seat is taken — a human's then-current name, or a
+disguised robot's freshly composed name — so the name an opponent sees is frozen for the life
+of the game (a later rename never rewrites past games) and a small pool of accounts presents
+as an ever-changing crowd. A reader falls back to the account's current name when a seat
+carries no snapshot (a pre-migration row). Each durable robot account still seeds a stable
+fallback name (32 composed per language), but the disguised reaper stamps a **fresh per-game
+name** drawn from a wide composed corpus: Western first/surname pools per locale (English,
+German, Spanish, Italian, French, Portuguese) in one of three forms (first only / first +
+surname initial / first + full surname), native Japanese/Chinese names, a gender-agreed
+Russian pool, and human-style handles (a stem, an optional `.`/`_`, an optional trailing
+number). Selection is **variant-aware**: a Russian game (Russian Scrabble or Эрудит) draws a
+Cyrillic name or handle with at most ~20% Latin analogue and **never a CJK script**; an
+English game draws the full international corpus. Every composed name stays within the
+editable display-name format (`account.ValidateDisplayName`) — which now admits a **trailing
+run of up to five digits** (so "Player2007"-style handles are valid for humans too) — so the
+disguised robot stays indistinguishable from a person.
 
 - **Balance**: at game start it decides once whether to play to win, with
   `P(play-to-win) ≈ 0.40` (so the human wins ≈ 60%), derived from the seed.