refactor(deploy): make DICT_VERSION a required build arg (single-sourced)

Drop the literal version default from the build files (backend Dockerfile both
stages, loadtest Dockerfile, the compose build-arg) so the release tag is not
duplicated as a stale-prone default a newcomer can't tell from the real source.

DICT_VERSION is now required: compose uses ${DICT_VERSION:?…} and the Dockerfiles
have no ARG default, so a missing value fails loudly instead of baking a stale tag.
The tag lives only in its genuine sources — ci.yaml env (CI tests), the Gitea
TEST_/PROD_DICT_VERSION variables (deploy seed) and deploy/.env.example (local).
Adds a "Bumping the dictionary version" section to deploy/README and fixes the bare
docker-build examples (CLAUDE.md, README.md, loadtest/README) to pass --build-arg.

deploy/README.md

@@ -117,6 +117,28 @@ collector's / gateway's internal IP is fine (connected route), but its `AWG_CONF
 which resolves `otelcol`, `gateway` and `api.telegram.org`. `GATEWAY_ADMIN_*` is
 intentionally **unset** — caddy owns `/_gm` in the contour.
 
+## Bumping the dictionary version
+
+The dictionary ships as a versioned **release artifact** (`scrabble-dawg-vX.Y.Z.tar.gz`) from
+[`scrabble-dictionary`](https://gitea.iliadenisov.ru/developer/scrabble-dictionary). The tag is
+a build-time input with **no default** in the images, so it is set in exactly two places to
+move the whole stack — change both to a new release:
+
+1. **CI tests** — `.gitea/workflows/ci.yaml` `env.DICT_VERSION` (the unit/integration jobs
+   download that dawg).
+2. **Deploy seed** — the Gitea repo variables `TEST_DICT_VERSION` / `PROD_DICT_VERSION` (the tag
+   the deploy bakes into a **fresh** volume's image; the deploy job feeds it to `compose` as
+   `DICT_VERSION`).
+
+For local builds set `DICT_VERSION` in `deploy/.env` (template: `.env.example`); a bare
+`docker build` needs `--build-arg DICT_VERSION=vX.Y.Z`. The Dockerfiles and `compose` carry no
+default — a missing value fails loudly instead of baking a stale tag.
+
+Bumping the seed is a **no-op on a live volume** (the `.seed_version` marker wins — the
+seed-drift guard). A running contour/prod moves to a new release **through the admin console**
+`/_gm/dictionary` (upload the tarball, preview the per-variant diff, confirm); in-flight games
+keep their pinned version, new games use the new one (ARCHITECTURE.md §5).
+
 ## Production rollout
 
 Prod runs on **two hosts** (main = full stack + ACME on the domain; tg = the bot only,