feat(export): server-rendered artifacts behind one signed download URL

The finished-game export now works identically on every platform: the
client mints a signed relative URL (game.export_url) carrying its date
locale, IANA time zone and localized non-play labels, resolves it
against its own origin and hands it to the platform's native download —
Telegram downloadFile, VKWebAppDownloadFile, or a plain browser anchor
(also the desktop VK iframe). Both artifacts ride the route: the .gcg
text (no more clipboard mode, except the legacy pre-8.0 Telegram
fallback) and the PNG of the final position.

The PNG is rasterized by a new internal 'renderer' sidecar (node:22-slim
+ skia-canvas + baked Liberation/Noto Color Emoji fonts) executing the
SAME ui/src/lib/gameimage.ts the web project unit-tests, bundled at
image build time — one renderer, no drift; the browser no longer draws
or delivers bytes itself. The backend rebuilds the render payload from
the journal + engine.AlphabetTable, verifies the HMAC (10-minute TTL,
BACKEND_EXPORT_SIGN_KEY, constant-time, uniform 404s) on its public
group, and streams the artifact as a named attachment; the gateway
forwards /dl/* behind the per-IP public rate limiter (caddy @gateway
matcher extended — the landing catch-all trap).

Deploy: renderer service (compose + prod overlay + roll before backend
+ prod push list), EXPORT_SIGN_KEY env (TEST_/PROD_ secrets), CI runs
the sidecar smoke in the ui job. Docs: ARCHITECTURE export-delivery
section, FUNCTIONAL(+_ru), UI_DESIGN, TESTING, deploy/README.

ui/src/lib/codec.test.ts

@@ -6,6 +6,7 @@ import {
   decodeBlockStatus,
   decodeDraftView,
   decodeEvent,
+  decodeExportUrl,
   decodeFriendList,
   decodeGameList,
   decodeInvitation,
@@ -24,6 +25,7 @@ import {
   encodeDraftSave,
   encodeEnqueue,
   encodeExchange,
+  encodeExportUrlRequest,
   encodeGuestLogin,
   encodeStateRequest,
   encodeSubmitPlay,
@@ -34,6 +36,30 @@ import {
 } from './codec';
 
 describe('codec', () => {
+  it('round-trips the export-url request and response', () => {
+    const req = fb.ExportUrlRequest.getRootAsExportUrlRequest(
+      new ByteBuffer(
+        encodeExportUrlRequest('g-1', 'png', 'ru-RU', ['пас', 'обмен', 'сдался', 'таймаут'], 'Europe/Moscow'),
+      ),
+    );
+    expect(req.gameId()).toBe('g-1');
+    expect(req.kind()).toBe('png');
+    expect(req.dateLocale()).toBe('ru-RU');
+    expect(req.timeZone()).toBe('Europe/Moscow');
+    expect(req.actionLabelsLength()).toBe(4);
+    expect(req.actionLabels(1)).toBe('обмен');
+
+    const b = new Builder(128);
+    const path = b.createString('/dl/g-1/png?e=1&s=x');
+    const fn = b.createString('game-g-1.png');
+    fb.ExportUrl.startExportUrl(b);
+    fb.ExportUrl.addPath(b, path);
+    fb.ExportUrl.addFilename(b, fn);
+    b.finish(fb.ExportUrl.endExportUrl(b));
+    const out = decodeExportUrl(b.asUint8Array());
+    expect(out).toEqual({ path: '/dl/g-1/png?e=1&s=x', filename: 'game-g-1.png' });
+  });
+
   it('encodes an enqueue request carrying the variant, word rule and vs_ai flag', () => {
     for (const vsAi of [false, true]) {
       const req = fb.EnqueueRequest.getRootAsEnqueueRequest(