feat(export): server-rendered artifacts behind one signed download URL

The finished-game export now works identically on every platform: the
client mints a signed relative URL (game.export_url) carrying its date
locale, IANA time zone and localized non-play labels, resolves it
against its own origin and hands it to the platform's native download —
Telegram downloadFile, VKWebAppDownloadFile, or a plain browser anchor
(also the desktop VK iframe). Both artifacts ride the route: the .gcg
text (no more clipboard mode, except the legacy pre-8.0 Telegram
fallback) and the PNG of the final position.

The PNG is rasterized by a new internal 'renderer' sidecar (node:22-slim
+ skia-canvas + baked Liberation/Noto Color Emoji fonts) executing the
SAME ui/src/lib/gameimage.ts the web project unit-tests, bundled at
image build time — one renderer, no drift; the browser no longer draws
or delivers bytes itself. The backend rebuilds the render payload from
the journal + engine.AlphabetTable, verifies the HMAC (10-minute TTL,
BACKEND_EXPORT_SIGN_KEY, constant-time, uniform 404s) on its public
group, and streams the artifact as a named attachment; the gateway
forwards /dl/* behind the per-IP public rate limiter (caddy @gateway
matcher extended — the landing catch-all trap).

Deploy: renderer service (compose + prod overlay + roll before backend
+ prod push list), EXPORT_SIGN_KEY env (TEST_/PROD_ secrets), CI runs
the sidecar smoke in the ui job. Docs: ARCHITECTURE export-delivery
section, FUNCTIONAL(+_ru), UI_DESIGN, TESTING, deploy/README.

gateway/internal/transcode/transcode_social.go

@@ -31,6 +31,7 @@ const (
 	MsgProfileUpdate     = "profile.update"
 	MsgStatsGet          = "stats.get"
 	MsgGameGCG           = "game.gcg"
+	MsgGameExportURL     = "game.export_url"
 )
 
 // registerSocialOps adds the social, account and history operations to the
@@ -56,6 +57,7 @@ func registerSocialOps(r *Registry, backend *backendclient.Client) {
 	r.ops[MsgProfileUpdate] = Op{Handler: profileUpdateHandler(backend), Auth: true}
 	r.ops[MsgStatsGet] = Op{Handler: statsHandler(backend), Auth: true}
 	r.ops[MsgGameGCG] = Op{Handler: gcgHandler(backend), Auth: true}
+	r.ops[MsgGameExportURL] = Op{Handler: exportURLHandler(backend), Auth: true}
 }
 
 // --- friends ---
@@ -290,6 +292,21 @@ func gcgHandler(backend *backendclient.Client) Handler {
 	}
 }
 
+func exportURLHandler(backend *backendclient.Client) Handler {
+	return func(ctx context.Context, req Request) ([]byte, error) {
+		in := fb.GetRootAsExportUrlRequest(req.Payload, 0)
+		labels := make([]string, 0, in.ActionLabelsLength())
+		for i := range in.ActionLabelsLength() {
+			labels = append(labels, string(in.ActionLabels(i)))
+		}
+		res, err := backend.ExportURL(ctx, req.UserID, string(in.GameId()), string(in.Kind()), string(in.DateLocale()), string(in.TimeZone()), labels)
+		if err != nil {
+			return nil, err
+		}
+		return encodeExportURL(res), nil
+	}
+}
+
 // decodeInviteeIDs reads the invitee id vector from a CreateInvitationRequest.
 func decodeInviteeIDs(in *fb.CreateInvitationRequest) []string {
 	n := in.InviteeIdsLength()