Stage 6: gateway edge (Connect/FlatBuffers over h2c, platform/email/guest auth, sessions, rate-limit, admin passthrough, live push bridge)

New public ingress and the first network edge. Framework + a vertical slice of
operations end-to-end; remaining ops reuse the same transcode pattern in Stage 7.

Contracts (new module scrabble/pkg):
- push.proto (backend->gateway gRPC server-stream) + scrabble.fbs (FlatBuffers
  edge payloads), committed generated Go; buf/flatc Makefiles (dev-time codegen).

Backend:
- REST handlers on the /api/v1 groups: internal session endpoints
  (telegram/guest/email login -> mint, resolve, revoke) and the user slice
  (profile, submit_play, state, lobby enqueue/poll, chat).
- internal/notify in-process Publisher hub + internal/pushgrpc gRPC server
  (BACKEND_GRPC_ADDR) streaming your_turn/opponent_moved/chat/nudge/match_found;
  emission in game.commit, social, matchmaker.
- migration 00005 accounts.is_guest; guests are durable rows excluded from stats;
  ProvisionGuest; email-as-login (RequestLoginCode/LoginWithCode).

Gateway (new module scrabble/gateway):
- Connect Gateway service over h2c (Execute + Subscribe), FlatBuffers<->JSON
  transcode registry, Telegram initData HMAC validator (seam), session cache,
  token-bucket rate limiter (3 classes), push fan-out hub, backend REST + push
  gRPC client, admin Basic-Auth reverse proxy.

go.work: use ./pkg, ./gateway + replace scrabble/pkg. CI: gateway/**, pkg/**
path filters; unit build/vet/test span all three modules. Docs (PLAN,
ARCHITECTURE, FUNCTIONAL+ru, TESTING, READMEs) updated; gateway/pkg unit tests +
guest/email-login integration tests.

pkg/proto/push/v1/push_grpc.pb.go

@@ -0,0 +1,141 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: push/v1/push.proto
+
+// Package scrabble.push.v1 is the backend -> gateway live-event control channel.
+// The gateway opens Subscribe once at startup and keeps the stream open; the
+// backend pushes one Event per notification intent. The payload is an opaque
+// FlatBuffers message (the scrabblefb.* tables) that the gateway forwards to the
+// client without re-interpreting it. The transport is plain gRPC server-stream
+// (ARCHITECTURE.md §2); the client edge is Connect-RPC (gateway/proto/edge).
+
+package pushv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	Push_Subscribe_FullMethodName = "/scrabble.push.v1.Push/Subscribe"
+)
+
+// PushClient is the client API for Push service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Push is the unidirectional live-event channel from backend to gateway.
+type PushClient interface {
+	// Subscribe opens the single backend -> gateway event stream. The backend
+	// sends every event for every user; the gateway fans them out to the active
+	// client subscriptions by user_id.
+	Subscribe(ctx context.Context, in *SubscribeRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Event], error)
+}
+
+type pushClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewPushClient(cc grpc.ClientConnInterface) PushClient {
+	return &pushClient{cc}
+}
+
+func (c *pushClient) Subscribe(ctx context.Context, in *SubscribeRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[Event], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &Push_ServiceDesc.Streams[0], Push_Subscribe_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[SubscribeRequest, Event]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Push_SubscribeClient = grpc.ServerStreamingClient[Event]
+
+// PushServer is the server API for Push service.
+// All implementations must embed UnimplementedPushServer
+// for forward compatibility.
+//
+// Push is the unidirectional live-event channel from backend to gateway.
+type PushServer interface {
+	// Subscribe opens the single backend -> gateway event stream. The backend
+	// sends every event for every user; the gateway fans them out to the active
+	// client subscriptions by user_id.
+	Subscribe(*SubscribeRequest, grpc.ServerStreamingServer[Event]) error
+	mustEmbedUnimplementedPushServer()
+}
+
+// UnimplementedPushServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedPushServer struct{}
+
+func (UnimplementedPushServer) Subscribe(*SubscribeRequest, grpc.ServerStreamingServer[Event]) error {
+	return status.Errorf(codes.Unimplemented, "method Subscribe not implemented")
+}
+func (UnimplementedPushServer) mustEmbedUnimplementedPushServer() {}
+func (UnimplementedPushServer) testEmbeddedByValue()              {}
+
+// UnsafePushServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to PushServer will
+// result in compilation errors.
+type UnsafePushServer interface {
+	mustEmbedUnimplementedPushServer()
+}
+
+func RegisterPushServer(s grpc.ServiceRegistrar, srv PushServer) {
+	// If the following call pancis, it indicates UnimplementedPushServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&Push_ServiceDesc, srv)
+}
+
+func _Push_Subscribe_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(SubscribeRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(PushServer).Subscribe(m, &grpc.GenericServerStream[SubscribeRequest, Event]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type Push_SubscribeServer = grpc.ServerStreamingServer[Event]
+
+// Push_ServiceDesc is the grpc.ServiceDesc for Push service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Push_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "scrabble.push.v1.Push",
+	HandlerType: (*PushServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "Subscribe",
+			Handler:       _Push_Subscribe_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "push/v1/push.proto",
+}