Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

backend/README.md

@@ -56,6 +56,17 @@ state. The matchmaker now substitutes a pooled robot after a 10-second wait and
 exposes `Poll` so a waiting player can collect the started game (the live
 match-found notification arrives with the `gateway`).
 
+Stage 6 opens the backend to the edge. The route groups gain their first
+handlers (`internal/server/handlers_*.go`): gateway-only session endpoints under
+`/api/v1/internal` (Telegram/guest/email login → mint, resolve, revoke) and a
+slice of authenticated `/api/v1/user` operations (profile, submit play, game
+state, lobby enqueue/poll, chat). A new `internal/notify` hub feeds a second
+listener — `internal/pushgrpc`, a gRPC server (`BACKEND_GRPC_ADDR`) streaming
+live events (your-turn, opponent-moved, chat, nudge, match-found) to the gateway.
+Migration `00005` adds `accounts.is_guest`: an ephemeral guest is a durable row
+with no identity, excluded from statistics. The shared wire contracts live in the
+sibling [`../pkg`](../pkg) module.
+
 ## Package layout
 
 ```
@@ -80,7 +91,8 @@ internal/robot/      # human-like robot opponent: account pool, seed-derived str
 
 | Variable | Default | Notes |
 | --- | --- | --- |
-| `BACKEND_HTTP_ADDR` | `:8080` | HTTP listen address. |
+| `BACKEND_HTTP_ADDR` | `:8080` | HTTP (REST) listen address. |
+| `BACKEND_GRPC_ADDR` | `:9090` | gRPC listen address for the live-event push stream to the gateway. |
 | `BACKEND_LOG_LEVEL` | `info` | `debug` / `info` / `warn` / `error`. |
 | `BACKEND_POSTGRES_DSN` | — | **Required.** pgx/libpq URL; must pin `search_path=backend`. |
 | `BACKEND_POSTGRES_MAX_OPEN_CONNS` | `25` | Pool max open connections. |