Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

docs/TESTING.md

@@ -7,7 +7,8 @@ tests or touching CI.
 
 - **Go unit tests** — table-driven where it helps; `testing` + standard library.
   Every functional change ships with regression coverage. Run:
-  `go test -count=1 ./backend/...` (the module list grows with the workspace).
+  `go test -count=1 ./backend/... ./pkg/... ./gateway/...` (the module list grows
+  with the workspace).
 - **Integration** *(Stage 1+)* — Postgres-backed tests behind the `integration`
   build tag spin a throwaway `postgres:17-alpine` via `testcontainers-go`. They
   live in `backend/internal/inttest` and run with
@@ -56,6 +57,20 @@ tests or touching CI.
   drives a robot through a full auto-match to a natural end (asserting a robot
   statistics row), the matchmaker substitution end-to-end (enqueue → reap →
   `[human, robot]`, discoverable via `Poll`), and a proactive 12-hour nudge.
+- **Gateway & contracts** *(Stage 6+)* — `backend/internal/notify` unit-tests the
+  hub fan-out (delivery, overflow drop, unsubscribe) and the FlatBuffers event
+  constructors (payload round-trip). `gateway/...` unit-tests are hermetic (no
+  real network — an `httptest` fake backend and fixtures): the Telegram initData
+  HMAC validator (genuine, tampered, wrong-token, stale), the session cache
+  (hit/miss/fallback, TTL re-resolve, invalidate), the rate limiter (burst,
+  per-key isolation, per-window), the push hub (per-user routing, overflow,
+  unsubscribe), the transcode round-trips (FlatBuffers↔JSON, X-User-ID
+  forwarding, nested GameView, domain-code surfacing), the admin Basic-Auth
+  reverse proxy (401 / forward), and a full Connect `Execute` path end to end
+  (guest auth, unauthenticated rejection, unknown message type). The backend gains
+  the **guest** lifecycle (a guest plays an auto-match to a natural end yet accrues
+  no statistics) and the **email-as-login** flow (request/verify, returning user)
+  in `inttest`.
 
 ## Principles