Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

pkg/proto/push/v1/push.proto

@@ -0,0 +1,36 @@
+syntax = "proto3";
+
+// Package scrabble.push.v1 is the backend -> gateway live-event control channel.
+// The gateway opens Subscribe once at startup and keeps the stream open; the
+// backend pushes one Event per notification intent. The payload is an opaque
+// FlatBuffers message (the scrabblefb.* tables) that the gateway forwards to the
+// client without re-interpreting it. The transport is plain gRPC server-stream
+// (ARCHITECTURE.md §2); the client edge is Connect-RPC (gateway/proto/edge).
+package scrabble.push.v1;
+
+option go_package = "scrabble/pkg/proto/push/v1;pushv1";
+
+// Push is the unidirectional live-event channel from backend to gateway.
+service Push {
+  // Subscribe opens the single backend -> gateway event stream. The backend
+  // sends every event for every user; the gateway fans them out to the active
+  // client subscriptions by user_id.
+  rpc Subscribe(SubscribeRequest) returns (stream Event);
+}
+
+// SubscribeRequest opens a push subscription. gateway_id identifies the gateway
+// instance for logging; the MVP backend keeps no per-gateway state.
+message SubscribeRequest {
+  string gateway_id = 1;
+}
+
+// Event is one live-event frame. kind is the notification catalog kind
+// (your_turn, opponent_moved, chat_message, nudge, match_found). payload is the
+// FlatBuffers-encoded body for that kind. event_id is a correlation id the
+// gateway carries through to the client envelope.
+message Event {
+  string user_id = 1;
+  string kind = 2;
+  bytes payload = 3;
+  string event_id = 4;
+}