feat(export): server-rendered artifacts behind one signed download URL

The finished-game export now works identically on every platform: the
client mints a signed relative URL (game.export_url) carrying its date
locale, IANA time zone and localized non-play labels, resolves it
against its own origin and hands it to the platform's native download —
Telegram downloadFile, VKWebAppDownloadFile, or a plain browser anchor
(also the desktop VK iframe). Both artifacts ride the route: the .gcg
text (no more clipboard mode, except the legacy pre-8.0 Telegram
fallback) and the PNG of the final position.

The PNG is rasterized by a new internal 'renderer' sidecar (node:22-slim
+ skia-canvas + baked Liberation/Noto Color Emoji fonts) executing the
SAME ui/src/lib/gameimage.ts the web project unit-tests, bundled at
image build time — one renderer, no drift; the browser no longer draws
or delivers bytes itself. The backend rebuilds the render payload from
the journal + engine.AlphabetTable, verifies the HMAC (10-minute TTL,
BACKEND_EXPORT_SIGN_KEY, constant-time, uniform 404s) on its public
group, and streams the artifact as a named attachment; the gateway
forwards /dl/* behind the per-IP public rate limiter (caddy @gateway
matcher extended — the landing catch-all trap).

Deploy: renderer service (compose + prod overlay + roll before backend
+ prod push list), EXPORT_SIGN_KEY env (TEST_/PROD_ secrets), CI runs
the sidecar smoke in the ui job. Docs: ARCHITECTURE export-delivery
section, FUNCTIONAL(+_ru), UI_DESIGN, TESTING, deploy/README.

renderer/test/render.test.mjs

@@ -0,0 +1,37 @@
+// Smoke test for the render core: feeds the committed fixture (a real 35-move self-played
+// Russian Scrabble game) through renderRequest and asserts a sane PNG comes back. Pixel
+// goldens are deliberately avoided — font rasterization differs across hosts; the shared
+// drawing logic itself is unit-tested in ui/ (gameimage.test.ts).
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { renderRequest } from '../src/render.mjs';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const fixture = () => JSON.parse(readFileSync(join(here, '../testdata/request.json'), 'utf8'));
+
+function pngSize(buf) {
+  // IHDR is the first chunk: width/height are big-endian u32 at offsets 16/20.
+  return { w: buf.readUInt32BE(16), h: buf.readUInt32BE(20) };
+}
+
+test('renders the fixture game to a plausible PNG', async () => {
+  const png = await renderRequest(fixture());
+  assert.ok(png.length > 50_000, `png too small: ${png.length}`);
+  assert.deepEqual([...png.subarray(0, 8)], [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+  const { w, h } = pngSize(png);
+  // scale 2 over a MIN_SIDE 620 board + two seat columns: sanity bounds, not a golden.
+  assert.ok(w > 1600 && w < 3000, `unexpected width ${w}`);
+  assert.ok(h > 1000 && h < 3000, `unexpected height ${h}`);
+});
+
+test('rejects a payload without a game', async () => {
+  await assert.rejects(() => renderRequest({ moves: [] }), /bad payload/);
+});
+
+test('renders concurrently without cross-talk', async () => {
+  const [a, b] = await Promise.all([renderRequest(fixture()), renderRequest(fixture())]);
+  assert.equal(a.length, b.length);
+});