feat(export): server-rendered artifacts behind one signed download URL

The finished-game export now works identically on every platform: the
client mints a signed relative URL (game.export_url) carrying its date
locale, IANA time zone and localized non-play labels, resolves it
against its own origin and hands it to the platform's native download —
Telegram downloadFile, VKWebAppDownloadFile, or a plain browser anchor
(also the desktop VK iframe). Both artifacts ride the route: the .gcg
text (no more clipboard mode, except the legacy pre-8.0 Telegram
fallback) and the PNG of the final position.

The PNG is rasterized by a new internal 'renderer' sidecar (node:22-slim
+ skia-canvas + baked Liberation/Noto Color Emoji fonts) executing the
SAME ui/src/lib/gameimage.ts the web project unit-tests, bundled at
image build time — one renderer, no drift; the browser no longer draws
or delivers bytes itself. The backend rebuilds the render payload from
the journal + engine.AlphabetTable, verifies the HMAC (10-minute TTL,
BACKEND_EXPORT_SIGN_KEY, constant-time, uniform 404s) on its public
group, and streams the artifact as a named attachment; the gateway
forwards /dl/* behind the per-IP public rate limiter (caddy @gateway
matcher extended — the landing catch-all trap).

Deploy: renderer service (compose + prod overlay + roll before backend
+ prod push list), EXPORT_SIGN_KEY env (TEST_/PROD_ secrets), CI runs
the sidecar smoke in the ui job. Docs: ARCHITECTURE export-delivery
section, FUNCTIONAL(+_ru), UI_DESIGN, TESTING, deploy/README.

gateway/internal/transcode/encode_social.go

@@ -251,6 +251,18 @@ func encodeInvitationList(r backendclient.InvitationListResp) []byte {
 	return b.FinishedBytes()
 }
 
+// encodeExportURL builds an ExportUrl payload.
+func encodeExportURL(r backendclient.ExportURLResp) []byte {
+	b := flatbuffers.NewBuilder(256)
+	path := b.CreateString(r.Path)
+	fn := b.CreateString(r.Filename)
+	fb.ExportUrlStart(b)
+	fb.ExportUrlAddPath(b, path)
+	fb.ExportUrlAddFilename(b, fn)
+	b.Finish(fb.ExportUrlEnd(b))
+	return b.FinishedBytes()
+}
+
 // encodeGcg builds a GcgExport payload.
 func encodeGcg(r backendclient.GcgResp) []byte {
 	b := flatbuffers.NewBuilder(1024)

gateway/internal/transcode/transcode_social.go

@@ -31,6 +31,7 @@ const (
 	MsgProfileUpdate     = "profile.update"
 	MsgStatsGet          = "stats.get"
 	MsgGameGCG           = "game.gcg"
+	MsgGameExportURL     = "game.export_url"
 )
 
 // registerSocialOps adds the social, account and history operations to the
@@ -56,6 +57,7 @@ func registerSocialOps(r *Registry, backend *backendclient.Client) {
 	r.ops[MsgProfileUpdate] = Op{Handler: profileUpdateHandler(backend), Auth: true}
 	r.ops[MsgStatsGet] = Op{Handler: statsHandler(backend), Auth: true}
 	r.ops[MsgGameGCG] = Op{Handler: gcgHandler(backend), Auth: true}
+	r.ops[MsgGameExportURL] = Op{Handler: exportURLHandler(backend), Auth: true}
 }
 
 // --- friends ---
@@ -290,6 +292,21 @@ func gcgHandler(backend *backendclient.Client) Handler {
 	}
 }
 
+func exportURLHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		in := fb.GetRootAsExportUrlRequest(req.Payload, 0)
+		labels := make([]string, 0, in.ActionLabelsLength())
+		for i := range in.ActionLabelsLength() {
+			labels = append(labels, string(in.ActionLabels(i)))
+		}
+		res, err := backend.ExportURL(ctx, req.UserID, string(in.GameId()), string(in.Kind()), string(in.DateLocale()), string(in.TimeZone()), labels)
+		if err != nil {
+			return nil, err
+		}
+		return encodeExportURL(res), nil
+	}
+}
+
 // decodeInviteeIDs reads the invitee id vector from a CreateInvitationRequest.
 func decodeInviteeIDs(in *fb.CreateInvitationRequest) []string {
 	n := in.InviteeIdsLength()

gateway/internal/transcode/transcode_social_test.go

@@ -263,6 +263,54 @@ func TestGcgRoundTrip(t *testing.T) {
 	}
 }
 
+func TestExportURLRoundTrip(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/user/games/g-1/export-url" {
+			t.Errorf("unexpected path %q", r.URL.Path)
+		}
+		q := r.URL.Query()
+		if q.Get("kind") != "png" || q.Get("dl") != "ru-RU" || q.Get("tz") != "Europe/Moscow" || q.Get("t") != "пас,обмен,сдался,таймаут" {
+			t.Errorf("unexpected query %q", r.URL.RawQuery)
+		}
+		_, _ = w.Write([]byte(`{"path":"/dl/g-1/png?e=1&s=x","filename":"game-g-1.png"}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, _ := reg.Lookup(transcode.MsgGameExportURL)
+
+	b := flatbuffers.NewBuilder(256)
+	gid := b.CreateString("g-1")
+	kind := b.CreateString("png")
+	dl := b.CreateString("ru-RU")
+	tz := b.CreateString("Europe/Moscow")
+	labels := make([]flatbuffers.UOffsetT, 0, 4)
+	for _, s := range []string{"пас", "обмен", "сдался", "таймаут"} {
+		labels = append(labels, b.CreateString(s))
+	}
+	fb.ExportUrlRequestStartActionLabelsVector(b, len(labels))
+	for i := len(labels) - 1; i >= 0; i-- {
+		b.PrependUOffsetT(labels[i])
+	}
+	vec := b.EndVector(len(labels))
+	fb.ExportUrlRequestStart(b)
+	fb.ExportUrlRequestAddGameId(b, gid)
+	fb.ExportUrlRequestAddKind(b, kind)
+	fb.ExportUrlRequestAddDateLocale(b, dl)
+	fb.ExportUrlRequestAddActionLabels(b, vec)
+	fb.ExportUrlRequestAddTimeZone(b, tz)
+	b.Finish(fb.ExportUrlRequestEnd(b))
+
+	payload, err := op.Handler(context.Background(), transcode.Request{UserID: "u-1", Payload: b.FinishedBytes()})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	res := fb.GetRootAsExportUrl(payload, 0)
+	if string(res.Path()) != "/dl/g-1/png?e=1&s=x" || string(res.Filename()) != "game-g-1.png" {
+		t.Fatalf("export url decoded wrong: path=%q filename=%q", res.Path(), res.Filename())
+	}
+}
+
 func TestProfileUpdateRoundTripAway(t *testing.T) {
 	var gotBody map[string]any
 	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {