Stage 16: deploy infra & test contour

- backend + gateway multi-stage distroless Dockerfiles; the gateway embeds and
  serves the SPA at / and /telegram/ via go:embed (committed dist placeholder,
  real build baked in by the image's node stage)
- deploy/docker-compose.yml: backend + gateway + Postgres + Telegram connector
  (VPN sidecar) + OTel Collector + Prometheus (15d) + Tempo (72h) + Grafana,
  fronted by a caddy owning a single /_gm Basic-Auth (admin console + Grafana
  subpath); inter-service on a private network, only caddy on the edge network
- new metrics: backend accounts_created_total{kind} (robots excluded) and an
  in-memory gateway active_users{window=24h,7d} gauge
- CI: single .gitea/workflows/ci.yaml (unit/integration/ui + a gated test-contour
  deploy) on the new feature/* -> development -> master branch model; the old
  go-unit/integration/ui-test workflows are folded in; the connector-scoped
  compose is retired (superseded by deploy/)
- docs: ARCHITECTURE §11/§12/§13, root + gateway READMEs, CLAUDE.md branching,
  PLAN.md (stage 16 done + refinements + Stage 17 forward-notes)

gateway/README.md

@@ -5,9 +5,13 @@ terminates the client's **Connect-RPC + FlatBuffers** traffic over HTTP/2
 cleartext (`h2c`), authenticates the originating credential, mints/resolves a
 thin opaque session, rate-limits, injects `X-User-ID` when forwarding to the
 backend over REST/JSON, and bridges the backend's gRPC push stream to each
-client's in-app live channel. It also serves the backend's admin console at `/_gm`
-on its public listener behind HTTP Basic-Auth. See
-[`../docs/ARCHITECTURE.md`](../docs/ARCHITECTURE.md) §2, §3, §10, §12.
+client's in-app live channel. It **embeds the static UI build** (`go:embed`, baked
+in by the gateway image's node stage) and serves the one SPA at `/` (web) and
+`/telegram/` (the Mini App) — the single-origin model. It can also serve the
+backend's admin console at `/_gm` behind HTTP Basic-Auth for a local non-caddy run;
+in the deployed contour the front caddy owns `/_gm` (see
+[`../deploy`](../deploy)). See
+[`../docs/ARCHITECTURE.md`](../docs/ARCHITECTURE.md) §2, §3, §10, §12, §13.
 
 ## Package layout
 
@@ -22,8 +26,9 @@ internal/ratelimit/     # token-bucket limiter (golang.org/x/time/rate)
 internal/connector/     # gRPC client to the Telegram connector (initData validate, out-of-app push) + routing
 internal/push/          # live-event fan-out hub (per-user client streams)
 internal/transcode/     # FlatBuffers<->REST bridge + message_type registry
-internal/connectsrv/    # the Connect Gateway service over h2c
+internal/connectsrv/    # the Connect Gateway service over h2c (+ the in-memory active_users gauge)
 internal/admin/         # Basic-Auth reverse proxy mounting the backend admin console at /_gm (verbatim)
+internal/webui/         # embedded SPA build (go:embed dist) served at / and /telegram/
 ```
 
 The FlatBuffers payloads and the backend push proto are the shared wire