chore(deploy): dedupe & regroup Gitea CI variables/secrets

Collapse identical TEST_/PROD_ pairs to single unprefixed Gitea entries, derive
the public URLs from PUBLIC_BASE_URL at deploy time, and share the prod env.sh
renderer between deploy and rollback.

- Collapse to one unprefixed variable: DICT_VERSION, SMTP_RELAY_HOST/PORT/TLS,
  GRAFANA_SMTP_PORT, VITE_VK_APP_LINK, VITE_VK_APP_ID (one Selectel relay + one
  pair of VK apps serve every contour). Secrets collapsed by the owner:
  SMTP_RELAY_USER/PASS, GATEWAY_VK_APP_SECRET, GATEWAY_VK_ID_CLIENT_SECRET.
- Derive at deploy from PUBLIC_BASE_URL (no longer stored): TELEGRAM_MINIAPP_URL,
  GRAFANA_ROOT_URL, VITE_VK_ID_REDIRECT_URL. Removes the prod/test asymmetry and
  fills the missing test VITE_VK_APP_ID (VK web login was half-configured on test).
- Extract deploy/write-prod-env.sh + write-prod-bot-env.sh, shared by prod-deploy
  and prod-rollback so the two cannot drift: a rollback now re-renders the FULL
  runtime env (email / VK login / Grafana alerts previously went dark after a
  rollback) and passes TELEGRAM_SUPPORT_CHAT_ID.
- Single-source DICT_VERSION (CI env + both deploys), fix the v1.3.0/v1.3.1 drift in
  .env.example/README, correct the misleading honeytoken/abuse-ban compose comment,
  and rewrite the deploy/README variable list (+ the previously undocumented
  GATEWAY_VK_APP_SECRET and TELEGRAM_SUPPORT_CHAT_ID).

The Gitea variables are reworked via the API; the stale TEST_/PROD_ entries are
deleted after the test contour goes green.

.gitea/workflows/ci.yaml

@@ -26,12 +26,12 @@ on:
   push:
     branches: [development]
 
-# The dictionary release the test suite validates against — the current
-# scrabble-dictionary release. Centralised here so a release bump is one edit; the
-# unit/integration jobs inherit it. The deploy job overrides it per contour with
-# vars.TEST_DICT_VERSION (the seed for a fresh volume), see deploy/README.md.
+# The dictionary release. One Gitea variable is the single source of truth: the
+# test suite validates against it here (inherited by the unit/integration jobs) and
+# both contours' deploy jobs seed a fresh volume with the same value. A release bump
+# is one edit (the variable). See deploy/README.md.
 env:
-  DICT_VERSION: v1.3.1
+  DICT_VERSION: ${{ vars.DICT_VERSION }}
 
 jobs:
   # changes detects which areas a PR/push touched, so the test jobs can skip when
@@ -329,20 +329,22 @@ jobs:
           TELEGRAM_PROMO_BOT_TOKEN: ${{ secrets.TEST_TELEGRAM_PROMO_BOT_TOKEN }}
           # VK Mini App protected key (offline HMAC for the launch-param signature); empty
           # leaves the VK auth path (auth.vk) disabled until the operator sets the secret.
-          GATEWAY_VK_APP_SECRET: ${{ secrets.TEST_GATEWAY_VK_APP_SECRET }}
+          # One VK Mini App serves every contour -> unprefixed secret.
+          GATEWAY_VK_APP_SECRET: ${{ secrets.GATEWAY_VK_APP_SECRET }}
           # VK ID web login (browser VK-identity linking): the VK ID "Web" app's protected key
           # for the server-side confidential code exchange — a SEPARATE VK app from the Mini
-          # App above. Empty leaves the link.vk.* ops disabled.
-          GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.TEST_GATEWAY_VK_ID_CLIENT_SECRET }}
+          # App above. One VK ID "Web" app serves every contour -> unprefixed secret.
+          GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.GATEWAY_VK_ID_CLIENT_SECRET }}
           # Signs the finished-game export download URLs (backend + compose interpolation).
           EXPORT_SIGN_KEY: ${{ secrets.TEST_EXPORT_SIGN_KEY }}
-          # Transactional email via the shared Selectel relay. Empty host leaves the
-          # backend on the log mailer (email disabled) but the contour still boots.
-          SMTP_RELAY_USER: ${{ secrets.TEST_SMTP_RELAY_USER }}
-          SMTP_RELAY_PASS: ${{ secrets.TEST_SMTP_RELAY_PASS }}
-          SMTP_RELAY_HOST: ${{ vars.TEST_SMTP_RELAY_HOST }}
-          SMTP_RELAY_PORT: ${{ vars.TEST_SMTP_RELAY_PORT }}
-          SMTP_RELAY_TLS: ${{ vars.TEST_SMTP_RELAY_TLS }}
+          # Transactional email via the shared Selectel relay: one account for every
+          # contour -> unprefixed host/port/tls/user/pass. Empty host leaves the backend
+          # on the log mailer (email disabled) but the contour still boots.
+          SMTP_RELAY_USER: ${{ secrets.SMTP_RELAY_USER }}
+          SMTP_RELAY_PASS: ${{ secrets.SMTP_RELAY_PASS }}
+          SMTP_RELAY_HOST: ${{ vars.SMTP_RELAY_HOST }}
+          SMTP_RELAY_PORT: ${{ vars.SMTP_RELAY_PORT }}
+          SMTP_RELAY_TLS: ${{ vars.SMTP_RELAY_TLS }}
           SMTP_RELAY_FROM: ${{ vars.TEST_SMTP_RELAY_FROM }}
           # Operator alerts: backend admin emails (new feedback / complaints) + Grafana
           # infra alerts. Distinct senders + recipients; Grafana uses the relay's STARTTLS
@@ -351,15 +353,15 @@ jobs:
           ADMIN_EMAIL: ${{ vars.TEST_ADMIN_EMAIL }}
           SMTP_RELAY_SERVICE_FROM: ${{ vars.TEST_SMTP_RELAY_SERVICE_FROM }}
           SERVICE_EMAIL: ${{ vars.TEST_SERVICE_EMAIL }}
-          GRAFANA_SMTP_PORT: ${{ vars.TEST_GRAFANA_SMTP_PORT }}
+          GRAFANA_SMTP_PORT: ${{ vars.GRAFANA_SMTP_PORT }}
           GF_SMTP_ENABLED: ${{ vars.TEST_GF_SMTP_ENABLED }}
           # Canonical public origin for links in the email (this contour's URL);
           # required by the backend whenever SMTP_RELAY_HOST is set.
           PUBLIC_BASE_URL: ${{ vars.TEST_PUBLIC_BASE_URL }}
           GM_BASICAUTH_USER: ${{ vars.TEST_GM_BASICAUTH_USER }}
-          GRAFANA_ROOT_URL: ${{ vars.TEST_GRAFANA_ROOT_URL }}
           CADDY_SITE_ADDRESS: ${{ vars.TEST_CADDY_SITE_ADDRESS }}
-          TELEGRAM_MINIAPP_URL: ${{ vars.TEST_TELEGRAM_MINIAPP_URL }}
+          # TELEGRAM_MINIAPP_URL, GRAFANA_ROOT_URL and VITE_VK_ID_REDIRECT_URL are derived
+          # from PUBLIC_BASE_URL in the run step below, not stored as their own variables.
           TELEGRAM_GAME_CHANNEL_ID: ${{ vars.TEST_TELEGRAM_GAME_CHANNEL_ID }}
           TELEGRAM_CHAT_ID: ${{ vars.TEST_TELEGRAM_CHAT_ID }}
           TELEGRAM_SUPPORT_CHAT_ID: ${{ vars.TEST_TELEGRAM_SUPPORT_CHAT_ID }}
@@ -372,16 +374,16 @@ jobs:
           VITE_TELEGRAM_BOT_ID: ${{ vars.TEST_VITE_TELEGRAM_BOT_ID }}
           VITE_TELEGRAM_LINK: ${{ vars.TEST_VITE_TELEGRAM_LINK }}
           VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.TEST_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
-          VITE_VK_APP_LINK: ${{ vars.TEST_VITE_VK_APP_LINK }}
-          # VK ID web login: the "Web" app id + its trusted redirect URL. One value each feeds
-          # both the SPA (the authorize URL) and the gateway (client_id / exchange redirect_uri).
-          VITE_VK_APP_ID: ${{ vars.TEST_VITE_VK_APP_ID }}
-          VITE_VK_ID_REDIRECT_URL: ${{ vars.TEST_VK_ID_REDIRECT_URL }}
-          VITE_GATEWAY_URL: ${{ vars.TEST_VITE_GATEWAY_URL }}
-          # Unset vars render empty -> the compose ":-" defaults apply.
+          # VK Mini App landing link + VK ID "Web" app id: one value each serves every
+          # contour -> unprefixed. VITE_VK_APP_ID also feeds the gateway (GATEWAY_VK_ID_APP_ID);
+          # the VK ID redirect URL is derived from PUBLIC_BASE_URL in the run step below.
+          VITE_VK_APP_LINK: ${{ vars.VITE_VK_APP_LINK }}
+          VITE_VK_APP_ID: ${{ vars.VITE_VK_APP_ID }}
+          # VITE_GATEWAY_URL omitted: the SPA is served same-origin, so it stays the
+          # compose ":-" empty default. Other unset vars likewise fall to their defaults.
           POSTGRES_DB: ${{ vars.TEST_POSTGRES_DB }}
           POSTGRES_USER: ${{ vars.TEST_POSTGRES_USER }}
-          DICT_VERSION: ${{ vars.TEST_DICT_VERSION }}
+          DICT_VERSION: ${{ vars.DICT_VERSION }}
           LOG_LEVEL: ${{ vars.TEST_LOG_LEVEL }}
         run: |
           # Seed the config files to a stable host path. The runner checks out into
@@ -394,6 +396,13 @@ jobs:
           mkdir -p "$conf"
           cp -r caddy otelcol prometheus tempo grafana blackbox "$conf"/
           export SCRABBLE_CONFIG_DIR="$conf"
+          # Derive the public URLs from the one canonical origin instead of storing each as
+          # its own variable (paths are structural SPA routes / the Caddy /_gm sub-path).
+          # Exported before build so the VK ID redirect is baked into the SPA.
+          base="${PUBLIC_BASE_URL%/}"
+          export TELEGRAM_MINIAPP_URL="$base/telegram/"
+          export GRAFANA_ROOT_URL="$base/_gm/grafana/"
+          export VITE_VK_ID_REDIRECT_URL="$base/app/"
           # Grafana's SMTP from_address must be a BARE address (it rejects the "Name" <addr>
           # form the backend go-mail accepts) and validates it even when SMTP is disabled — a
           # bad value crash-loops Grafana. Split the display-format SERVICE From into a bare