Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

README.md

@@ -29,15 +29,18 @@ supports English Scrabble, Russian Scrabble and Эрудит.
 ## Build & test
 
 ```sh
-go build ./backend/...  # per module (the workspace spans several modules)
-go vet ./backend/...
-gofmt -l .              # must print nothing
-go test -count=1 ./backend/...                       # unit tests
-go test -tags=integration -count=1 -p=1 ./backend/... # + Postgres (needs Docker)
+go build ./backend/... ./pkg/... ./gateway/...  # per module (the workspace spans several)
+go vet ./backend/... ./pkg/... ./gateway/...
+gofmt -l .                                       # must print nothing
+go test -count=1 ./backend/... ./pkg/... ./gateway/...   # unit tests
+go test -tags=integration -count=1 -p=1 ./backend/...    # + Postgres (needs Docker)
 ```
 
 The `integration`-tagged tests start a throwaway `postgres:17-alpine` container
-via testcontainers-go and require a reachable Docker daemon.
+via testcontainers-go and require a reachable Docker daemon; they live in the
+`backend` module. The wire contracts in `pkg` and the Connect edge in `gateway`
+have committed generated code (regenerate dev-time with `make -C pkg gen` /
+`make -C gateway gen`).
 
 ## Run the backend locally
 
@@ -47,7 +50,17 @@ migrations at startup:
 ```sh
 docker run -d --name scrabble-pg -e POSTGRES_PASSWORD=dev -p 5432:5432 postgres:17-alpine
 BACKEND_POSTGRES_DSN='postgres://postgres:dev@localhost:5432/postgres?search_path=backend&sslmode=disable' \
-  go run ./backend/cmd/backend     # serves /healthz and /readyz on :8080
+  go run ./backend/cmd/backend     # HTTP API + probes on :8080, push gRPC on :9090
+```
+
+## Run the gateway locally
+
+The gateway is the public edge; point it at a running backend:
+
+```sh
+GATEWAY_BACKEND_HTTP_URL=http://localhost:8080 \
+GATEWAY_BACKEND_GRPC_ADDR=localhost:9090 \
+  go run ./gateway/cmd/gateway     # Connect/h2c edge on :8081
 ```
 
 Key environment: `BACKEND_HTTP_ADDR` (default `:8080`), `BACKEND_LOG_LEVEL`