Round-6 follow-up: UX polish + client-IP fix

- Client IP: the compose caddy trusts X-Forwarded-For from private-range
  upstreams (trusted_proxies private_ranges), so the real client IP survives
  the host-caddy hop (it was logging the docker caddy hop 172.18.0.x for chat
  moderation and bucketing the gateway per-IP rate limiter on it). Correct and
  spoof-safe in both contours (prod has no host caddy); peerIP unit-tested.
- Ad banner gated off behind a compile-time SHOW_AD_BANNER=false (the if-branch,
  the AdBanner import and banner.ts are tree-shaken out of the prod bundle).
- Landing: the Telegram entry is just the 64px logo (clickable, no button/text).
- TG-fullscreen header: title + menu centred as a pair (hamburger right of the
  title), pinned to the bottom of the TG nav band.
- Edge-swipe back (Screen): a left-edge rightward drag navigates to back
  (touch/pen only, armed from <=24px; skipped inside Telegram).
- Chat soft-keyboard: a bottom-sheet Modal lifted above the keyboard by a
  visualViewport-driven transform (compositor-only, no page/sheet relayout).
  iOS-specific, needs on-device tuning; native resize=none awaits Capacitor.
- Tests: e2e for the in-game '✓ in friends' item and a board→board tile
  relocation; codec units for last_activity_unix + OutgoingRequestList.

Deferred to the next PR (agreed): #4 enrich the your-turn/game-end push; #5 hide
finished games from the lobby.

ui/src/components/Screen.svelte

@@ -2,6 +2,8 @@
   import type { Snippet } from 'svelte';
   import Header from './Header.svelte';
   import AdBanner from './AdBanner.svelte';
+  import { navigate } from '../lib/router.svelte';
+  import { insideTelegram } from '../lib/telegram';
 
   // The app-shell layout (all screens): the nav bar grows; the ad strip, content and
   // optional tab bar pin to the bottom (ad directly above the content). Pass `scroll`
@@ -27,11 +29,35 @@
     // (the game makes only its board scroll while the score/rack/tab bar stay put).
     column?: boolean;
   } = $props();
+
+  // The promotional banner is feature-gated OFF until it is polished after release. The flag is
+  // a compile-time `false`, so the {#if} branch — and with it the AdBanner import and its
+  // banner.ts logic — is dead-code-eliminated from the production bundle (Stage 17). Flip to
+  // true to bring it back.
+  const SHOW_AD_BANNER = false;
+
+  // Edge-swipe back (Stage 17): a left-edge rightward drag returns to `back`, the standard
+  // mobile gesture. Armed only from the very left edge (<=24px) so it never competes with the
+  // board's own horizontal gestures; touch/pen only. Skipped inside Telegram, whose native
+  // back button + swipe already cover this (and would otherwise double up).
+  function onEdgeDown(e: PointerEvent): void {
+    if (!back || e.pointerType === 'mouse' || insideTelegram() || e.clientX > 24) return;
+    const x0 = e.clientX;
+    const y0 = e.clientY;
+    const onUp = (ev: PointerEvent) => {
+      window.removeEventListener('pointerup', onUp);
+      const dx = ev.clientX - x0;
+      const dy = ev.clientY - y0;
+      if (back && dx > 64 && Math.abs(dx) > Math.abs(dy) * 1.4) navigate(back);
+    };
+    window.addEventListener('pointerup', onUp);
+  }
 </script>
 
-<div class="screen">
+<!-- svelte-ignore a11y_no_static_element_interactions -->
+<div class="screen" onpointerdown={onEdgeDown}>
   <Header {title} {back} {menu} grow={growNav} />
-  <AdBanner />
+  {#if SHOW_AD_BANNER}<AdBanner />{/if}
   <main class="content" class:scroll class:fill={!growNav} class:column>{@render children?.()}</main>
   {#if tabbar}
     <nav class="tabbar">{@render tabbar()}</nav>