feat(telemetry): local move-preview adoption metrics (Phase 4)

Measure uptake of the client-side local move-preview accelerator (§5) so
adoption can be watched before defaulting it on: app cold starts, dictionary
loads by result (fetched / cache_hit / miss) and move previews by path
(local / network — the backend load shed).

A small best-effort client beacon (POST /metrics/local-eval, session-gated)
batches counter deltas and posts them on a 60s timer and when the app is
backgrounded — never on the gameplay path: the in-app counters are plain
in-memory increments, only the periodic flush touches the network and it is
fire-and-forget. The gateway folds each batch into three OTel counters
(local_eval_cold_start_total, local_eval_dict_load_total,
local_eval_preview_total), clamped against a spoofed inflation.

- gateway: counters + recordLocalEval + session-gated /metrics/local-eval handler
- ui: localeval-metrics accumulator/beacon; hooks in the dict loader, in
  Game.recompute and in bootstrap (skipped under the mock harness)
- caddy: route /metrics/* to the gateway
- docs: ARCHITECTURE §11; Grafana "Scrabble — Users" dashboard panels

docs/ARCHITECTURE.md

@@ -955,6 +955,20 @@ edits take effect on the next `profile.get` (open/reconnect/foreground), not mid
   distinct accounts that performed an authenticated edge action in the window. The
   gauge is single-process by design (single-instance MVP, §10): it is correct for one
   gateway, resets on restart, and is a live operational figure, not a billing count.
+- **Local-preview adoption (client-reported):** three gateway counters measure uptake of
+  the local move-preview accelerator (§5), fed by a small, best-effort client beacon
+  (`POST /metrics/local-eval`, session-gated) that batches counter deltas and posts them
+  on a 60 s timer and when the app is backgrounded — **never on the gameplay path** (the
+  in-app counters are plain in-memory increments; only the periodic flush touches the
+  network, fire-and-forget). `local_eval_cold_start_total` counts app cold starts (the
+  adoption denominator); `local_eval_dict_load_total` (`result` = fetched/cache_hit/miss)
+  splits a dawg download that fills IndexedDB from a cache hit and from a warm-up that
+  failed or timed out; `local_eval_preview_total` (`path` = local/network) is the share of
+  previews computed on-device versus the network `evaluate` fallback — the backend load
+  shed. It answers the owner's adoption question — how often the app opens versus how often
+  it fills IndexedDB — and is surfaced on the **Scrabble — Users** dashboard. Lossy by
+  design (a dropped beacon just retries its batch on the next flush); it is telemetry, never
+  a game input.
 - **Rate-limit observability:** every limiter rejection increments the gateway
   counter `gateway_rate_limited_total` (`class` = user/public/email/admin — aggregate
   only, honouring the no-per-user-label discipline above) and logs one **Debug** line;