Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

gateway/internal/push/hub.go

@@ -0,0 +1,88 @@
+// Package push is the gateway's live-event fan-out. The gateway holds one
+// backend gRPC subscription that feeds Publish; each connected client opens a
+// Subscribe stream and receives only the events addressed to its user id. A slow
+// client never blocks the backend feed — its bounded queue drops on overflow.
+package push
+
+import "sync"
+
+// Event is one live event addressed to a user. Payload is the FlatBuffers body
+// the gateway forwards verbatim to the client.
+type Event struct {
+	UserID  string
+	Kind    string
+	Payload []byte
+	EventID string
+}
+
+// defaultBuffer is the per-client queue depth used when NewHub is given a
+// non-positive size.
+const defaultBuffer = 64
+
+// Hub fans backend events out to per-user client subscriptions.
+type Hub struct {
+	bufSize int
+
+	mu     sync.Mutex
+	nextID int
+	subs   map[int]*subscription
+}
+
+type subscription struct {
+	userID string
+	ch     chan Event
+}
+
+// NewHub constructs a Hub whose per-client queue holds bufSize events.
+func NewHub(bufSize int) *Hub {
+	if bufSize <= 0 {
+		bufSize = defaultBuffer
+	}
+	return &Hub{bufSize: bufSize, subs: make(map[int]*subscription)}
+}
+
+// Publish delivers e to every subscription for e.UserID, dropping it for any
+// whose queue is full.
+func (h *Hub) Publish(e Event) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	for _, s := range h.subs {
+		if s.userID != e.UserID {
+			continue
+		}
+		select {
+		case s.ch <- e:
+		default:
+		}
+	}
+}
+
+// Subscribe registers a client stream for userID and returns its event channel
+// and an unsubscribe func that closes the channel.
+func (h *Hub) Subscribe(userID string) (<-chan Event, func()) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	id := h.nextID
+	h.nextID++
+	s := &subscription{userID: userID, ch: make(chan Event, h.bufSize)}
+	h.subs[id] = s
+	return s.ch, func() { h.unsubscribe(id) }
+}
+
+// unsubscribe removes and closes a subscription. It holds the same lock as
+// Publish, so it never closes a channel mid-send.
+func (h *Hub) unsubscribe(id int) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if s, ok := h.subs[id]; ok {
+		delete(h.subs, id)
+		close(s.ch)
+	}
+}
+
+// SubscriberCount returns the number of active subscriptions (for tests/metrics).
+func (h *Hub) SubscriberCount() int {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return len(h.subs)
+}

gateway/internal/push/hub_test.go

@@ -0,0 +1,56 @@
+package push_test
+
+import (
+	"testing"
+
+	"scrabble/gateway/internal/push"
+)
+
+func TestHubRoutesByUser(t *testing.T) {
+	h := push.NewHub(4)
+	chA, cancelA := h.Subscribe("user-a")
+	defer cancelA()
+	chB, cancelB := h.Subscribe("user-b")
+	defer cancelB()
+
+	h.Publish(push.Event{UserID: "user-a", Kind: "your_turn"})
+
+	select {
+	case e := <-chA:
+		if e.Kind != "your_turn" {
+			t.Fatalf("user-a received %q", e.Kind)
+		}
+	default:
+		t.Fatal("user-a should have received the event")
+	}
+	select {
+	case <-chB:
+		t.Fatal("user-b must not receive user-a's event")
+	default:
+	}
+}
+
+func TestHubDropsOnOverflow(t *testing.T) {
+	h := push.NewHub(1)
+	ch, cancel := h.Subscribe("u")
+	defer cancel()
+	for i := 0; i < 5; i++ {
+		h.Publish(push.Event{UserID: "u", Kind: "chat_message"})
+	}
+	if got := len(ch); got != 1 {
+		t.Fatalf("buffered %d events, want 1 (overflow dropped)", got)
+	}
+}
+
+func TestHubUnsubscribeClosesChannel(t *testing.T) {
+	h := push.NewHub(2)
+	ch, cancel := h.Subscribe("u")
+	cancel()
+	if _, ok := <-ch; ok {
+		t.Fatal("channel should be closed after unsubscribe")
+	}
+	if h.SubscriberCount() != 0 {
+		t.Fatalf("subscriber count = %d, want 0", h.SubscriberCount())
+	}
+	h.Publish(push.Event{UserID: "u"}) // must not panic
+}