feat(export): server-rendered artifacts behind one signed download URL

The finished-game export now works identically on every platform: the
client mints a signed relative URL (game.export_url) carrying its date
locale, IANA time zone and localized non-play labels, resolves it
against its own origin and hands it to the platform's native download —
Telegram downloadFile, VKWebAppDownloadFile, or a plain browser anchor
(also the desktop VK iframe). Both artifacts ride the route: the .gcg
text (no more clipboard mode, except the legacy pre-8.0 Telegram
fallback) and the PNG of the final position.

The PNG is rasterized by a new internal 'renderer' sidecar (node:22-slim
+ skia-canvas + baked Liberation/Noto Color Emoji fonts) executing the
SAME ui/src/lib/gameimage.ts the web project unit-tests, bundled at
image build time — one renderer, no drift; the browser no longer draws
or delivers bytes itself. The backend rebuilds the render payload from
the journal + engine.AlphabetTable, verifies the HMAC (10-minute TTL,
BACKEND_EXPORT_SIGN_KEY, constant-time, uniform 404s) on its public
group, and streams the artifact as a named attachment; the gateway
forwards /dl/* behind the per-IP public rate limiter (caddy @gateway
matcher extended — the landing catch-all trap).

Deploy: renderer service (compose + prod overlay + roll before backend
+ prod push list), EXPORT_SIGN_KEY env (TEST_/PROD_ secrets), CI runs
the sidecar smoke in the ui job. Docs: ARCHITECTURE export-delivery
section, FUNCTIONAL(+_ru), UI_DESIGN, TESTING, deploy/README.

docs/ARCHITECTURE.md

@@ -785,11 +785,32 @@ the same rows and is likewise self-contained — we ship our own writer (the sol
 exposes none): the standard Poslfit dialect (UTF-8, `#player`/`#lexicon`
 pragmas, `8G`/`H8` coordinates, lower-case blanks, `.` pass-throughs, `-TILES`
 exchanges), plus `#note` lines for resignations and timeouts, which the standard
-does not cover. **GCG export is offered only on a finished game** (`game.ErrGameActive`
-otherwise), so an in-progress journal is never leaked mid-play; the client
-shares the `.gcg` file via the Web Share API where available; an Android in-app WebView
-(Telegram / VK) has no Web Share and silently ignores an `<a download>`, so there it copies the GCG
-text to the clipboard instead (the payload is tiny), and a plain desktop browser downloads the file.
+does not cover. **Export is offered only on a finished game** (`game.ErrGameActive`
+otherwise), so an in-progress journal is never leaked mid-play.
+
+**Export delivery — the signed download URL.** Both export artifacts — the `.gcg` text
+and the rendered **PNG of the final position** — travel one uniform route on every
+platform: the client calls the authenticated `game.export_url` op, the backend mints a
+**relative, HMAC-signed, short-lived path**
+(`/dl/{game}/{kind}?e=<expiry>&…&s=<HMAC-SHA256>`, 10-minute TTL,
+`BACKEND_EXPORT_SIGN_KEY`), and the client resolves it against its **own origin** (no
+service ever needs to know the public host) and hands it to the platform's native
+download: Telegram `downloadFile` (Bot API 8.0), `VKWebAppDownloadFile`, or a plain
+browser anchor elsewhere (including the desktop VK iframe). The GET is the gateway's
+**only unauthenticated data route** (`/dl/*` — in the caddy `@gateway` matcher and the
+per-IP public rate limiter): the native download calls carry no cookies or headers, so
+the URL's signature — verified by the backend on its `/api/v1/public` group in constant
+time, every failure a uniform 404 — is the whole grant, and minting requires an
+authenticated caller on a finished game. The PNG is rasterized on demand by the
+**`renderer` sidecar** (internal-only Node + skia-canvas running the same
+`ui/src/lib/gameimage.ts` the web project unit-tests — one renderer, no drift;
+`renderer/README.md`); the backend rebuilds the render payload from the journal +
+`engine.AlphabetTable`, and the client's date locale plus its UI-localized non-play
+labels ride the signed URL so the server render matches the player's presentation.
+Nothing is stored: the artifact is re-derived from the immutable finished journal on
+each GET. The only remaining platform branch is a legacy Telegram client predating
+`downloadFile`, where the GCG falls back to the old clipboard copy and the image option
+is not offered.
 
 The alphabet-on-the-wire transport does **not** touch this invariant: the live edge
 exchanges alphabet indices, but the persisted journal (and everything derived from it —