Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

backend/internal/server/handlers_test.go

@@ -0,0 +1,82 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"scrabble/backend/internal/account"
+	"scrabble/backend/internal/game"
+	"scrabble/backend/internal/session"
+)
+
+// newRoutingServer builds a Server with non-nil (zero-value) services so the
+// routes register. The tests below exercise only the request-validation and
+// routing layers, which return before any service method is called; full
+// endpoint behaviour against real services is covered by the integration suite.
+func newRoutingServer() *Server {
+	return New(":0", Deps{
+		Sessions: &session.Service{},
+		Accounts: &account.Store{},
+		Games:    &game.Service{},
+	})
+}
+
+func do(t *testing.T, s *Server, method, path, body string, headers map[string]string) *httptest.ResponseRecorder {
+	t.Helper()
+	var rdr *strings.Reader
+	if body != "" {
+		rdr = strings.NewReader(body)
+	} else {
+		rdr = strings.NewReader("")
+	}
+	req := httptest.NewRequest(method, path, rdr)
+	req.Header.Set("Content-Type", "application/json")
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
+	rec := httptest.NewRecorder()
+	s.Handler().ServeHTTP(rec, req)
+	return rec
+}
+
+func TestAdminPingOK(t *testing.T) {
+	rec := do(t, newRoutingServer(), http.MethodGet, "/api/v1/admin/ping", "", nil)
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), `"status":"ok"`) {
+		t.Fatalf("admin ping = %d %q", rec.Code, rec.Body.String())
+	}
+}
+
+func TestProfileRequiresUserID(t *testing.T) {
+	rec := do(t, newRoutingServer(), http.MethodGet, "/api/v1/user/profile", "", nil)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("profile without X-User-ID = %d, want 401", rec.Code)
+	}
+}
+
+func TestResolveSessionRejectsEmptyToken(t *testing.T) {
+	rec := do(t, newRoutingServer(), http.MethodPost, "/api/v1/internal/sessions/resolve", `{}`, nil)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("resolve with empty token = %d, want 400", rec.Code)
+	}
+}
+
+func TestSubmitPlayRejectsBadDirection(t *testing.T) {
+	headers := map[string]string{"X-User-ID": uuid.New().String()}
+	path := "/api/v1/user/games/" + uuid.New().String() + "/play"
+	rec := do(t, newRoutingServer(), http.MethodPost, path, `{"dir":"X","tiles":[]}`, headers)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("submit play bad dir = %d, want 400", rec.Code)
+	}
+}
+
+func TestSubmitPlayRejectsBadGameID(t *testing.T) {
+	headers := map[string]string{"X-User-ID": uuid.New().String()}
+	rec := do(t, newRoutingServer(), http.MethodPost, "/api/v1/user/games/not-a-uuid/play", `{"dir":"H"}`, headers)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("submit play bad game id = %d, want 400", rec.Code)
+	}
+}