Stage 16: deploy infra & test contour

- backend + gateway multi-stage distroless Dockerfiles; the gateway embeds and
  serves the SPA at / and /telegram/ via go:embed (committed dist placeholder,
  real build baked in by the image's node stage)
- deploy/docker-compose.yml: backend + gateway + Postgres + Telegram connector
  (VPN sidecar) + OTel Collector + Prometheus (15d) + Tempo (72h) + Grafana,
  fronted by a caddy owning a single /_gm Basic-Auth (admin console + Grafana
  subpath); inter-service on a private network, only caddy on the edge network
- new metrics: backend accounts_created_total{kind} (robots excluded) and an
  in-memory gateway active_users{window=24h,7d} gauge
- CI: single .gitea/workflows/ci.yaml (unit/integration/ui + a gated test-contour
  deploy) on the new feature/* -> development -> master branch model; the old
  go-unit/integration/ui-test workflows are folded in; the connector-scoped
  compose is retired (superseded by deploy/)
- docs: ARCHITECTURE §11/§12/§13, root + gateway READMEs, CLAUDE.md branching,
  PLAN.md (stage 16 done + refinements + Stage 17 forward-notes)

gateway/internal/connectsrv/server.go

@@ -24,6 +24,7 @@ import (
 	"scrabble/gateway/internal/ratelimit"
 	"scrabble/gateway/internal/session"
 	"scrabble/gateway/internal/transcode"
+	"scrabble/gateway/internal/webui"
 	edgev1 "scrabble/gateway/proto/edge/v1"
 	"scrabble/gateway/proto/edge/v1/edgev1connect"
 )
@@ -89,9 +90,21 @@ func (s *Server) HTTPHandler() http.Handler {
 	if s.adminProxy != nil {
 		// The admin console (backend /_gm) is served on the public listener behind
 		// the proxy's Basic-Auth, mounted below the h2c wrap so the Connect edge keeps
-		// working over h2c (docs/ARCHITECTURE.md §12).
+		// working over h2c (docs/ARCHITECTURE.md §12). In the deployed contour the
+		// front caddy owns the /_gm Basic-Auth and Grafana routing; this mount serves
+		// a non-caddy (local) setup.
 		mux.Handle("/_gm/", s.adminProxy)
+	} else {
+		// With the console disabled here, keep /_gm a 404 so the SPA catch-all below
+		// does not serve the app shell at the operator path.
+		mux.Handle("/_gm/", http.NotFoundHandler())
 	}
+	// The embedded single-page UI is served at the site root and, for the Telegram
+	// Mini App, under /telegram/ — the single-origin model (docs/ARCHITECTURE.md
+	// §13). Both mounts sit below the h2c wrap so the Connect edge (a more specific
+	// prefix) keeps priority; "/" is the catch-all SPA fallback for the hash router.
+	mux.Handle("/telegram/", webui.Handler("/telegram/"))
+	mux.Handle("/", webui.Handler(""))
 	return h2c.NewHandler(mux, &http2.Server{})
 }
 
@@ -118,6 +131,9 @@ func (s *Server) Execute(ctx context.Context, req *connect.Request[edgev1.Execut
 			result = "unauthenticated"
 			return nil, err
 		}
+		// A valid session proving an authenticated request is an "action" for the
+		// active_users gauge, counted before the rate-limit/domain outcome.
+		s.metrics.recordActive(uid)
 		if !s.limiter.Allow("user:"+uid, s.userPolicy) {
 			result = "rate_limited"
 			return nil, connect.NewError(connect.CodeResourceExhausted, errRateLimited)