Round-6 follow-up: UX polish + client-IP fix

- Client IP: the compose caddy trusts X-Forwarded-For from private-range
  upstreams (trusted_proxies private_ranges), so the real client IP survives
  the host-caddy hop (it was logging the docker caddy hop 172.18.0.x for chat
  moderation and bucketing the gateway per-IP rate limiter on it). Correct and
  spoof-safe in both contours (prod has no host caddy); peerIP unit-tested.
- Ad banner gated off behind a compile-time SHOW_AD_BANNER=false (the if-branch,
  the AdBanner import and banner.ts are tree-shaken out of the prod bundle).
- Landing: the Telegram entry is just the 64px logo (clickable, no button/text).
- TG-fullscreen header: title + menu centred as a pair (hamburger right of the
  title), pinned to the bottom of the TG nav band.
- Edge-swipe back (Screen): a left-edge rightward drag navigates to back
  (touch/pen only, armed from <=24px; skipped inside Telegram).
- Chat soft-keyboard: a bottom-sheet Modal lifted above the keyboard by a
  visualViewport-driven transform (compositor-only, no page/sheet relayout).
  iOS-specific, needs on-device tuning; native resize=none awaits Capacitor.
- Tests: e2e for the in-game '✓ in friends' item and a board→board tile
  relocation; codec units for last_activity_unix + OutgoingRequestList.

Deferred to the next PR (agreed): #4 enrich the your-turn/game-end push; #5 hide
finished games from the lobby.

ui/src/components/Header.svelte

@@ -89,11 +89,25 @@
     transform: rotate(45deg);
     margin-left: 3px;
   }
-  /* Telegram fullscreen: its native nav overlays the top of the viewport (height
-     --tg-content-top, set from the content-safe-area inset). Drop the header content below the
-     nav and lift the menu up into the nav band, centred — Telegram's own controls sit in the
-     corners, leaving the centre clear (Stage 17). */
+  /* Telegram fullscreen: TG's native nav overlays a band of height --tg-content-top at the top
+     of the viewport. Pull our title + menu up into the BOTTOM of that band and centre them as a
+     pair (hamburger right of the title) so they line up with Telegram's own nav controls rather
+     than floating above them (Stage 17). */
   :global(html.tg-fullscreen) .bar {
-    padding-top: var(--tg-content-top);
+    min-height: var(--tg-content-top);
+    box-sizing: border-box;
+    align-items: flex-end;
+    justify-content: center;
+    padding-top: 0;
+    padding-bottom: 6px;
+  }
+  :global(html.tg-fullscreen) .spacer {
+    display: none;
+  }
+  :global(html.tg-fullscreen) h1 {
+    flex: 0 1 auto;
+  }
+  :global(html.tg-fullscreen) .end {
+    min-width: 0;
   }
 </style>