feat(export): server-rendered artifacts behind one signed download URL

The finished-game export now works identically on every platform: the
client mints a signed relative URL (game.export_url) carrying its date
locale, IANA time zone and localized non-play labels, resolves it
against its own origin and hands it to the platform's native download —
Telegram downloadFile, VKWebAppDownloadFile, or a plain browser anchor
(also the desktop VK iframe). Both artifacts ride the route: the .gcg
text (no more clipboard mode, except the legacy pre-8.0 Telegram
fallback) and the PNG of the final position.

The PNG is rasterized by a new internal 'renderer' sidecar (node:22-slim
+ skia-canvas + baked Liberation/Noto Color Emoji fonts) executing the
SAME ui/src/lib/gameimage.ts the web project unit-tests, bundled at
image build time — one renderer, no drift; the browser no longer draws
or delivers bytes itself. The backend rebuilds the render payload from
the journal + engine.AlphabetTable, verifies the HMAC (10-minute TTL,
BACKEND_EXPORT_SIGN_KEY, constant-time, uniform 404s) on its public
group, and streams the artifact as a named attachment; the gateway
forwards /dl/* behind the per-IP public rate limiter (caddy @gateway
matcher extended — the landing catch-all trap).

Deploy: renderer service (compose + prod overlay + roll before backend
+ prod push list), EXPORT_SIGN_KEY env (TEST_/PROD_ secrets), CI runs
the sidecar smoke in the ui job. Docs: ARCHITECTURE export-delivery
section, FUNCTIONAL(+_ru), UI_DESIGN, TESTING, deploy/README.

gateway/internal/transcode/transcode_social_test.go

@@ -263,6 +263,54 @@ func TestGcgRoundTrip(t *testing.T) {
 	}
 }
 
+func TestExportURLRoundTrip(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/user/games/g-1/export-url" {
+			t.Errorf("unexpected path %q", r.URL.Path)
+		}
+		q := r.URL.Query()
+		if q.Get("kind") != "png" || q.Get("dl") != "ru-RU" || q.Get("tz") != "Europe/Moscow" || q.Get("t") != "пас,обмен,сдался,таймаут" {
+			t.Errorf("unexpected query %q", r.URL.RawQuery)
+		}
+		_, _ = w.Write([]byte(`{"path":"/dl/g-1/png?e=1&s=x","filename":"game-g-1.png"}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, _ := reg.Lookup(transcode.MsgGameExportURL)
+
+	b := flatbuffers.NewBuilder(256)
+	gid := b.CreateString("g-1")
+	kind := b.CreateString("png")
+	dl := b.CreateString("ru-RU")
+	tz := b.CreateString("Europe/Moscow")
+	labels := make([]flatbuffers.UOffsetT, 0, 4)
+	for _, s := range []string{"пас", "обмен", "сдался", "таймаут"} {
+		labels = append(labels, b.CreateString(s))
+	}
+	fb.ExportUrlRequestStartActionLabelsVector(b, len(labels))
+	for i := len(labels) - 1; i >= 0; i-- {
+		b.PrependUOffsetT(labels[i])
+	}
+	vec := b.EndVector(len(labels))
+	fb.ExportUrlRequestStart(b)
+	fb.ExportUrlRequestAddGameId(b, gid)
+	fb.ExportUrlRequestAddKind(b, kind)
+	fb.ExportUrlRequestAddDateLocale(b, dl)
+	fb.ExportUrlRequestAddActionLabels(b, vec)
+	fb.ExportUrlRequestAddTimeZone(b, tz)
+	b.Finish(fb.ExportUrlRequestEnd(b))
+
+	payload, err := op.Handler(context.Background(), transcode.Request{UserID: "u-1", Payload: b.FinishedBytes()})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	res := fb.GetRootAsExportUrl(payload, 0)
+	if string(res.Path()) != "/dl/g-1/png?e=1&s=x" || string(res.Filename()) != "game-g-1.png" {
+		t.Fatalf("export url decoded wrong: path=%q filename=%q", res.Path(), res.Filename())
+	}
+}
+
 func TestProfileUpdateRoundTripAway(t *testing.T) {
 	var gotBody map[string]any
 	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {