feat(gateway,ui): client-version gate — turn away too-old builds

Introduce a minimum-supported-client gate so a future incompatible wire change
can turn away installed builds too old to speak it, cleanly, instead of letting
them crash on decode. It rides the outermost stable layer (an HTTP header), never
the FlatBuffers payload.

Gateway:
- New internal/clientver: dependency-free parse + compare of the leading
  MAJOR.MINOR.PATCH (a git-describe suffix is tolerated).
- GATEWAY_MIN_CLIENT_VERSION config (empty => gate dormant; validated at load).
- connectsrv checks the X-Client-Version header before decoding the payload:
  Execute returns result_code="update_required" (before the registry lookup),
  Subscribe returns FailedPrecondition. It fails open on an absent or garbled
  header — the header is a client-controlled compatibility signal, not an access
  control.

Client:
- Attach X-Client-Version on every call.
- A terminal update.svelte.ts store + a non-dismissable UpdateOverlay (native
  opens VITE_STORE_URL, web reloads); retry.ts maps FailedPrecondition to the
  update_required sentinel; a mock __update hook drives the e2e.

Wire-additive and contour-safe: no FBS/proto regen, no schema migration; the gate
stays dormant until GATEWAY_MIN_CLIENT_VERSION is deliberately set, so web / VK /
Telegram behaviour is unchanged. The silent reconciliation seam is deferred to the
offline-first work (its only caller). Tests: Go clientver/config/connectsrv gate
tests, retry.test.ts, Playwright update.spec.ts.

ui/e2e/update.spec.ts

@@ -0,0 +1,34 @@
+import { expect, test } from './fixtures';
+
+// The "update required" overlay is raised in prod when the edge's client-version gate turns away a
+// too-old build (the update_required result_code on Execute, a Subscribe FailedPrecondition). The
+// mock transport never produces one, so — like the maintenance overlay — the e2e drives it through
+// the window.__update hook (gateway.ts, mock-only). It is app-global (mounted outside the route
+// blocks in App.svelte), so it shows without a session, and it is terminal (no self-clearing poll).
+test('update overlay covers the app when the client is too old', async ({ page }) => {
+  await page.goto('/');
+  await expect(page.getByRole('alertdialog')).toHaveCount(0);
+
+  await page.evaluate(() => (window as unknown as { __update: { on(): void } }).__update.on());
+  const overlay = page.getByRole('alertdialog');
+  await expect(overlay).toBeVisible();
+  // One action button (EN "Update" / RU "Обновить" depending on locale).
+  await expect(overlay.getByRole('button', { name: /Update|Обновить/i })).toBeVisible();
+});
+
+test('the update action reloads the web client', async ({ page }) => {
+  await page.goto('/');
+  await page.evaluate(() => (window as unknown as { __update: { on(): void } }).__update.on());
+  const overlay = page.getByRole('alertdialog');
+  await expect(overlay).toBeVisible();
+
+  // On the web the action reloads the page to fetch the current client (on a native build it opens
+  // the store instead). The reload resets the terminal store, so the app re-bootstraps: the overlay
+  // is gone and the login is back.
+  await Promise.all([
+    page.waitForEvent('load'),
+    overlay.getByRole('button', { name: /Update|Обновить/i }).click(),
+  ]);
+  await expect(page.getByRole('alertdialog')).toHaveCount(0);
+  await expect(page.getByRole('button', { name: /guest/i })).toBeVisible();
+});