Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

pkg/Makefile

@@ -0,0 +1,40 @@
+# Code generation for the shared wire contracts (proto push channel + the
+# FlatBuffers edge payloads). The generated Go is COMMITTED; CI only builds it,
+# so this Makefile is a dev-time tool (the same model as backend/cmd/jetgen).
+#
+# Prerequisites:
+#   make tools                 # go install the local protoc-gen-* plugins
+#   flatc $(REQUIRED_FLATC)    # for `make fbs`
+# Then:
+#   make gen                   # proto + fbs
+.PHONY: gen proto fbs flatc-check tools
+
+# Pinned flatc version: the committed Go bindings under fbs/scrabblefb/ and the
+# flatbuffers Go runtime (go.mod) are on this version. Generating with a
+# different flatc silently churns output and can flip wire defaults.
+REQUIRED_FLATC := 23.5.26
+
+GOBIN := $(shell go env GOBIN)
+ifeq ($(GOBIN),)
+GOBIN := $(shell go env GOPATH)/bin
+endif
+
+gen: proto fbs
+
+# tools installs the local buf plugins. Pin versions to the runtime libraries in
+# go.mod (google.golang.org/protobuf, google.golang.org/grpc).
+tools:
+	go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11
+	go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
+
+proto:
+	PATH="$(GOBIN):$$PATH" buf generate
+
+flatc-check:
+	@command -v flatc >/dev/null || { echo "flatc not found; install flatc $(REQUIRED_FLATC)"; exit 1; }
+	@flatc --version | grep -q "$(REQUIRED_FLATC)" || { echo "flatc $(REQUIRED_FLATC) required; found '$$(flatc --version)'"; exit 1; }
+
+# --go-module-name rewrites cross-table imports to the fully-qualified module
+# path so the generated code links without local replace directives.
+fbs: flatc-check
+	flatc --go --go-module-name scrabble/pkg/fbs -o fbs fbs/scrabble.fbs