feat: on-device move preview (local eval) with network fallback

Score and validate a tentative move on-device instead of a per-arrangement network
round trip. The dawg reader and the validate/score/direction slice of the
scrabble-solver engine are ported to TypeScript (ui/src/lib/dict), pinned
byte-for-byte to the Go engine by a `conformance` CI job (full-dictionary reader
parity plus a battery of plays across every variant and both cross-word rules,
including the inferred orientation). The server stays authoritative — submit_play
re-validates — so the local result is an advisory accelerator only.

- backend: Registry.DictBytes + an authed GET /api/v1/user/dict/{variant}/{version}
  (immutable) streaming the pinned per-game dawg; caddy routes /dict to the gateway.
- gateway: a session-gated /dict edge route proxying it; fetchDict on the transport.
- client: the dictionary loads on game open (low priority so it never starves the
  game on a slow link; aborted at a 5s cap or when leaving the game), is cached in
  IndexedDB (best-effort, self-healing on a rejected blob) and reused across
  sessions; a warm-up overlay covers a cold load, then the network preview is the
  fallback; a bad-connection breaker stops warming after repeated misses; the move
  preview cancels its in-flight request when the tiles change.
- parity generators backend/cmd/{dictgen,validategen} + gated Vitest suites, run in
  CI against the release dictionaries. A hidden debug readout lists the cached
  dictionaries + breaker state, and its reset clears the cache.
- docs: ARCHITECTURE §5, TESTING, UI_DESIGN, FUNCTIONAL (+ru).

gateway/internal/connectsrv/server.go

@@ -68,6 +68,7 @@ const (
 type Server struct {
 	registry   *transcode.Registry
 	sessions   *session.Cache
+	backend    *backendclient.Client
 	limiter    *ratelimit.Limiter
 	tracker    *ratelimit.Tracker
 	banlist    *ratelimit.Banlist
@@ -91,7 +92,10 @@ type Server struct {
 type Deps struct {
 	Registry *transcode.Registry
 	Sessions *session.Cache
-	Limiter  *ratelimit.Limiter
+	// Backend is the REST client backing the session-gated /dict blob route; a nil
+	// value disables that route (it 404s).
+	Backend *backendclient.Client
+	Limiter *ratelimit.Limiter
 	// Tracker accumulates limiter rejections for the periodic report; nil
 	// selects a private tracker (rejections are then only counted, never
 	// reported).
@@ -142,6 +146,7 @@ func NewServer(d Deps) *Server {
 	return &Server{
 		registry:     d.Registry,
 		sessions:     d.Sessions,
+		backend:      d.Backend,
 		limiter:      limiter,
 		tracker:      tracker,
 		banlist:      banlist,
@@ -183,6 +188,9 @@ func (s *Server) HTTPHandler() http.Handler {
 		// does not serve the app shell at the operator path.
 		mux.Handle("/_gm/", http.NotFoundHandler())
 	}
+	// The client-side local move preview pulls each game's pinned dictionary blob
+	// through this session-gated route (not public); see dictBytesHandler.
+	mux.Handle("/dict/", s.dictBytesHandler())
 	// The embedded UI: the game SPA under /app/ (web), /telegram/ (the Telegram Mini
 	// App) and /vk/ (the VK Mini App) — the single-origin model (docs/ARCHITECTURE.md
 	// §13). All sit below the h2c wrap so the Connect edge (a more specific prefix) keeps
@@ -397,6 +405,75 @@ func (s *Server) limitAdmin(next http.Handler) http.Handler {
 	})
 }
 
+// dictBytesHandler serves the raw dictionary blob for a (variant, version) pair to
+// a signed-in client (the local move preview), proxying the backend's authed
+// endpoint. It is session-gated — not public — bounds the download with the
+// user-class limiter, and forwards the backend's immutable Cache-Control so the
+// browser caches the blob hard. Only GET is allowed; the path is
+// /dict/{variant}/{version}.
+func (s *Server) dictBytesHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.backend == nil {
+			http.NotFound(w, r)
+			return
+		}
+		if r.Method != http.MethodGet {
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		ip := peerIP(r.RemoteAddr, r.Header)
+		if !s.limiter.Allow("user:"+ip, s.userPolicy) {
+			s.noteRateLimited(r.Context(), classUser, ip, "dict")
+			http.Error(w, "rate limited", http.StatusTooManyRequests)
+			return
+		}
+		uid, _, err := s.resolve(r.Context(), r.Header, ip)
+		if err != nil {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		variant, version, ok := parseDictPath(r.URL.Path)
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		data, cacheControl, err := s.backend.DictBytes(r.Context(), uid, variant, version)
+		if err != nil {
+			var apiErr *backendclient.APIError
+			if errors.As(err, &apiErr) && apiErr.Status < http.StatusInternalServerError {
+				http.NotFound(w, r) // unknown variant or version
+				return
+			}
+			s.log.Warn("dict fetch failed", zap.Error(err))
+			http.Error(w, "bad gateway", http.StatusBadGateway)
+			return
+		}
+		if cacheControl != "" {
+			w.Header().Set("Cache-Control", cacheControl)
+		}
+		w.Header().Set("Content-Type", "application/octet-stream")
+		_, _ = w.Write(data)
+	})
+}
+
+// parseDictPath splits /dict/{variant}/{version}; both segments must be present
+// and non-empty, and the version must not contain a further slash.
+func parseDictPath(p string) (variant, version string, ok bool) {
+	rest, found := strings.CutPrefix(p, "/dict/")
+	if !found {
+		return "", "", false
+	}
+	i := strings.IndexByte(rest, '/')
+	if i <= 0 || i == len(rest)-1 {
+		return "", "", false
+	}
+	variant, version = rest[:i], rest[i+1:]
+	if strings.Contains(version, "/") {
+		return "", "", false
+	}
+	return variant, version, true
+}
+
 // resolve extracts and resolves the Authorization bearer token to an account id
 // and its guest flag, returning a Connect Unauthenticated error when it is missing
 // or unknown.