feat(export): server-rendered artifacts behind one signed download URL

The finished-game export now works identically on every platform: the
client mints a signed relative URL (game.export_url) carrying its date
locale, IANA time zone and localized non-play labels, resolves it
against its own origin and hands it to the platform's native download —
Telegram downloadFile, VKWebAppDownloadFile, or a plain browser anchor
(also the desktop VK iframe). Both artifacts ride the route: the .gcg
text (no more clipboard mode, except the legacy pre-8.0 Telegram
fallback) and the PNG of the final position.

The PNG is rasterized by a new internal 'renderer' sidecar (node:22-slim
+ skia-canvas + baked Liberation/Noto Color Emoji fonts) executing the
SAME ui/src/lib/gameimage.ts the web project unit-tests, bundled at
image build time — one renderer, no drift; the browser no longer draws
or delivers bytes itself. The backend rebuilds the render payload from
the journal + engine.AlphabetTable, verifies the HMAC (10-minute TTL,
BACKEND_EXPORT_SIGN_KEY, constant-time, uniform 404s) on its public
group, and streams the artifact as a named attachment; the gateway
forwards /dl/* behind the per-IP public rate limiter (caddy @gateway
matcher extended — the landing catch-all trap).

Deploy: renderer service (compose + prod overlay + roll before backend
+ prod push list), EXPORT_SIGN_KEY env (TEST_/PROD_ secrets), CI runs
the sidecar smoke in the ui job. Docs: ARCHITECTURE export-delivery
section, FUNCTIONAL(+_ru), UI_DESIGN, TESTING, deploy/README.

ui/e2e/export.spec.ts

@@ -1,18 +1,31 @@
 import { expect, test, type Page } from './fixtures';
 
 // The finished-game export: the history header's 📤 button opens the app's own format
-// chooser modal — never Telegram's native popup, whose callback runs without user
-// activation and so kills navigator.share / clipboard writes (verified on-device).
-// The PNG option is offered only outside the in-app WebViews (no working binary
-// delivery there until the server-rendered signed-URL path lands); the GCG file is
-// always offered. g3 ("vs Rick") is the seeded finished game. Web Share is
-// force-disabled per test so both engines deterministically exercise the download
-// branch.
+// chooser (never Telegram's native popup — its callback carries no user activation),
+// and BOTH formats travel the same unified route on every platform: the client mints a
+// signed relative URL (game.export_url), resolves it against its own origin and hands
+// it to the platform's native download — Telegram downloadFile / VKWebAppDownloadFile —
+// or a plain anchor download in a browser. g3 ("vs Rick") is the seeded finished game.
+// The mock gateway returns a shape-faithful /dl/... path; the tests intercept that
+// route and serve bytes, so the download itself is exercised end to end.
 
-async function disableWebShare(page: Page): Promise<void> {
-  await page.addInitScript(() => {
-    Object.defineProperty(navigator, 'canShare', { value: () => false, configurable: true });
-    Object.defineProperty(navigator, 'share', { value: undefined, configurable: true });
+// A minimal valid 1×1 PNG, hex-decoded without node typings (the e2e tsconfig has none).
+const PNG_HEX =
+  '89504e470d0a1a0a0000000d49484452000000010000000108060000001f15c489' +
+  '0000000a49444154789c6360000000020001e221bc330000000049454e44ae426082';
+const PNG_BYTES = Uint8Array.from({ length: PNG_HEX.length / 2 }, (_, i) =>
+  parseInt(PNG_HEX.slice(i * 2, i * 2 + 2), 16),
+);
+
+async function routeDl(page: Page): Promise<void> {
+  await page.route('**/dl/**', (route) => {
+    const png = route.request().url().includes('/png');
+    return route.fulfill({
+      status: 200,
+      contentType: png ? 'image/png' : 'text/plain; charset=utf-8',
+      headers: { 'Content-Disposition': 'attachment' },
+      body: png ? PNG_BYTES : '#character-encoding UTF-8\n',
+    });
   });
 }
 
@@ -25,20 +38,18 @@ async function openFinishedHistory(page: Page): Promise<void> {
   await expect(page.getByRole('button', { name: 'Export game' })).toBeVisible();
 }
 
-test('the export chooser downloads the PNG image on a plain browser', async ({ page }) => {
-  await disableWebShare(page);
+test('the chooser downloads the PNG through the signed URL on a plain browser', async ({ page }) => {
+  await routeDl(page);
   await openFinishedHistory(page);
   await page.getByRole('button', { name: 'Export game' }).click();
 
-  // The app's own chooser modal offers both formats on the plain web.
-  await expect(page.getByRole('button', { name: 'GCG file' })).toBeVisible();
   const download = page.waitForEvent('download');
   await page.getByRole('button', { name: 'Image (PNG)' }).click();
   expect((await download).suggestedFilename()).toMatch(/^game-.+\.png$/);
 });
 
-test('the export chooser downloads the GCG file on a plain browser', async ({ page }) => {
-  await disableWebShare(page);
+test('the chooser downloads the GCG through the same signed-URL route', async ({ page }) => {
+  await routeDl(page);
   await openFinishedHistory(page);
   await page.getByRole('button', { name: 'Export game' }).click();
 
@@ -47,13 +58,9 @@ test('the export chooser downloads the GCG file on a plain browser', async ({ pa
   expect((await download).suggestedFilename()).toMatch(/^game-.+\.gcg$/);
 });
 
-test('inside Telegram the chooser is the app modal and withholds the image option', async ({
-  page,
-}) => {
-  await disableWebShare(page);
-  // A Telegram WebApp stub with showPopup present: were the chooser still native, it would
-  // be called — the spy locks the regression (its activation-less callback breaks share and
-  // clipboard delivery on real devices).
+test('inside Telegram both formats go through the native downloadFile dialog', async ({ page }) => {
+  // A Telegram stub with downloadFile present (Bot API 8.0): the image option is offered
+  // and the artifact is handed to the native download — never an in-webview anchor.
   await page.addInitScript(() => {
     Object.assign(window, {
       Telegram: {
@@ -62,9 +69,9 @@ test('inside Telegram the chooser is the app modal and withholds the image optio
           initDataUnsafe: {},
           ready() {},
           expand() {},
-          showPopup(_params: unknown, cb: (id: string) => void) {
-            (window as unknown as { __popupCalled?: boolean }).__popupCalled = true;
-            setTimeout(() => cb(''), 0);
+          downloadFile(params: { url: string; file_name: string }) {
+            const w = window as unknown as { __downloads?: { url: string; file_name: string }[] };
+            (w.__downloads ??= []).push(params);
           },
         },
       },
@@ -77,11 +84,49 @@ test('inside Telegram the chooser is the app modal and withholds the image optio
   await page.locator('.scoreboard').click();
   await page.getByRole('button', { name: 'Export game' }).click();
 
-  // The app's own modal opened with the GCG option only — no PNG in an in-app WebView…
+  await page.getByRole('button', { name: 'Image (PNG)' }).click();
+  await expect
+    .poll(() =>
+      page.evaluate(() => (window as unknown as { __downloads?: { url: string; file_name: string }[] }).__downloads),
+    )
+    .toHaveLength(1);
+  const dl = await page.evaluate(
+    () => (window as unknown as { __downloads: { url: string; file_name: string }[] }).__downloads[0],
+  );
+  // The relative signed path was resolved against the app's own origin — absolute for TG.
+  expect(dl.url).toMatch(/^http.+\/dl\/.+\/png\?/);
+  expect(dl.file_name).toMatch(/^game-.+\.png$/);
+});
+
+test('a legacy Telegram client (no downloadFile) hides the image and copies the GCG', async ({ page }) => {
+  await page.addInitScript(() => {
+    // Headless engines deny the real clipboard; a permissive stub keeps the legacy
+    // copy path deterministic in both browsers.
+    Object.defineProperty(navigator, 'clipboard', {
+      value: { writeText: async () => {} },
+      configurable: true,
+    });
+    Object.assign(window, {
+      Telegram: {
+        WebApp: {
+          initData: 'query_id=test&user=%7B%22id%22%3A1%7D&auth_date=1&hash=deadbeef',
+          initDataUnsafe: {},
+          ready() {},
+          expand() {},
+        },
+      },
+    });
+  });
+  await page.goto('/');
+  await expect(page.getByText('Your turn')).toBeVisible();
+  await page.getByRole('button', { name: /Rick/ }).click();
+  await expect(page.locator('[data-cell]').first()).toBeVisible();
+  await page.locator('.scoreboard').click();
+  await page.getByRole('button', { name: 'Export game' }).click();
+
+  // No image option without the native download; the GCG stays available (clipboard path).
   await expect(page.getByRole('button', { name: 'GCG file' })).toBeVisible();
   await expect(page.getByRole('button', { name: 'Image (PNG)' })).toHaveCount(0);
-  // …and the native popup was never used for the chooser.
-  expect(
-    await page.evaluate(() => (window as unknown as { __popupCalled?: boolean }).__popupCalled),
-  ).toBeFalsy();
+  await page.getByRole('button', { name: 'GCG file' }).click();
+  await expect(page.getByText('GCG copied to the clipboard.')).toBeVisible();
 });