Round-6 follow-up: UX polish + client-IP fix

- Client IP: the compose caddy trusts X-Forwarded-For from private-range
  upstreams (trusted_proxies private_ranges), so the real client IP survives
  the host-caddy hop (it was logging the docker caddy hop 172.18.0.x for chat
  moderation and bucketing the gateway per-IP rate limiter on it). Correct and
  spoof-safe in both contours (prod has no host caddy); peerIP unit-tested.
- Ad banner gated off behind a compile-time SHOW_AD_BANNER=false (the if-branch,
  the AdBanner import and banner.ts are tree-shaken out of the prod bundle).
- Landing: the Telegram entry is just the 64px logo (clickable, no button/text).
- TG-fullscreen header: title + menu centred as a pair (hamburger right of the
  title), pinned to the bottom of the TG nav band.
- Edge-swipe back (Screen): a left-edge rightward drag navigates to back
  (touch/pen only, armed from <=24px; skipped inside Telegram).
- Chat soft-keyboard: a bottom-sheet Modal lifted above the keyboard by a
  visualViewport-driven transform (compositor-only, no page/sheet relayout).
  iOS-specific, needs on-device tuning; native resize=none awaits Capacitor.
- Tests: e2e for the in-game '✓ in friends' item and a board→board tile
  relocation; codec units for last_activity_unix + OutgoingRequestList.

Deferred to the next PR (agreed): #4 enrich the your-turn/game-end push; #5 hide
finished games from the lobby.

ui/src/lib/codec.test.ts

@@ -8,6 +8,7 @@ import {
   decodeGameList,
   decodeInvitation,
   decodeLinkResult,
+  decodeOutgoingList,
   decodeSession,
   decodeStateView,
   decodeStats,
@@ -109,6 +110,7 @@ describe('codec', () => {
     fb.GameView.addMoveCount(b, 4);
     fb.GameView.addEndReason(b, er);
     fb.GameView.addSeats(b, seats);
+    fb.GameView.addLastActivityUnix(b, BigInt(1717000000));
     const game = fb.GameView.endGameView(b);
     const games = fb.GameList.createGamesVector(b, [game]);
     fb.GameList.startGameList(b);
@@ -120,6 +122,22 @@ describe('codec', () => {
     expect(gl.games[0].id).toBe('g1');
     expect(gl.games[0].seats[0].displayName).toBe('Ann');
     expect(gl.games[0].seats[0].score).toBe(13);
+    expect(gl.games[0].lastActivityUnix).toBe(1717000000);
+  });
+
+  it('decodes an OutgoingRequestList of account refs', () => {
+    const b = new Builder(128);
+    const id = b.createString('o-1');
+    const dn = b.createString('Pat');
+    fb.AccountRef.startAccountRef(b);
+    fb.AccountRef.addAccountId(b, id);
+    fb.AccountRef.addDisplayName(b, dn);
+    const ref = fb.AccountRef.endAccountRef(b);
+    const vec = fb.OutgoingRequestList.createRequestsVector(b, [ref]);
+    fb.OutgoingRequestList.startOutgoingRequestList(b);
+    fb.OutgoingRequestList.addRequests(b, vec);
+    b.finish(fb.OutgoingRequestList.endOutgoingRequestList(b));
+    expect(decodeOutgoingList(b.asUint8Array())).toEqual([{ accountId: 'o-1', displayName: 'Pat' }]);
   });
 
   it('encodes a TargetRequest', () => {