feat(gateway,ui): client-version gate — turn away too-old builds

Introduce a minimum-supported-client gate so a future incompatible wire change
can turn away installed builds too old to speak it, cleanly, instead of letting
them crash on decode. It rides the outermost stable layer (an HTTP header), never
the FlatBuffers payload.

Gateway:
- New internal/clientver: dependency-free parse + compare of the leading
  MAJOR.MINOR.PATCH (a git-describe suffix is tolerated).
- GATEWAY_MIN_CLIENT_VERSION config (empty => gate dormant; validated at load).
- connectsrv checks the X-Client-Version header before decoding the payload:
  Execute returns result_code="update_required" (before the registry lookup),
  Subscribe returns FailedPrecondition. It fails open on an absent or garbled
  header — the header is a client-controlled compatibility signal, not an access
  control.

Client:
- Attach X-Client-Version on every call.
- A terminal update.svelte.ts store + a non-dismissable UpdateOverlay (native
  opens VITE_STORE_URL, web reloads); retry.ts maps FailedPrecondition to the
  update_required sentinel; a mock __update hook drives the e2e.

Wire-additive and contour-safe: no FBS/proto regen, no schema migration; the gate
stays dormant until GATEWAY_MIN_CLIENT_VERSION is deliberately set, so web / VK /
Telegram behaviour is unchanged. The silent reconciliation seam is deferred to the
offline-first work (its only caller). Tests: Go clientver/config/connectsrv gate
tests, retry.test.ts, Playwright update.spec.ts.

ui/src/lib/transport.ts

@@ -17,6 +17,7 @@ import { offlineMode } from './offline.svelte';
 import { maintenanceRecovered, registerMaintenanceProbe, reportMaintenance } from './maintenance.svelte';
 import { maintenanceRetryMs } from './maintenance';
 import { backoffMs, isConnectionCode, retryable, toGatewayError } from './retry';
+import { UPDATE_REQUIRED, reportUpdateRequired } from './update.svelte';
 
 const MAX_RETRIES = 6;
 const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
@@ -34,8 +35,14 @@ export function createTransport(baseUrl: string): GatewayClient {
   const client = createClient(Gateway, transport);
   let token: string | null = null;
 
-  const headers = (): Record<string, string> | undefined =>
-    token ? { authorization: `Bearer ${token}` } : undefined;
+  // Every call carries the build version so the edge's client-version gate can turn away a build
+  // too old to speak the current wire contract, before it decodes the payload (the header rides the
+  // outermost stable layer; see docs/ARCHITECTURE.md §2).
+  const headers = (): Record<string, string> => {
+    const h: Record<string, string> = { 'x-client-version': __APP_VERSION__ };
+    if (token) h.authorization = `Bearer ${token}`;
+    return h;
+  };
 
   // The reachability probe the connection watcher fires while offline: a cheap authenticated read
   // (it must reject when there is no session, so the watcher keeps waiting rather than reporting up).
@@ -71,6 +78,8 @@ export function createTransport(baseUrl: string): GatewayClient {
           throw toGatewayError(e);
         }
         const err = toGatewayError(e);
+        // A too-old client turned away on a foreground call raises the terminal update overlay.
+        if (err.code === UPDATE_REQUIRED) reportUpdateRequired();
         if (retryable(err.code, messageType) && attempt < MAX_RETRIES) {
           reportOffline();
           await sleep(backoffMs(attempt + 1));
@@ -83,7 +92,10 @@ export function createTransport(baseUrl: string): GatewayClient {
       // A read got through: if the maintenance overlay was up, the deploy window has ended —
       // reload to pick up the (possibly incompatible) fresh client (maintenance.svelte.ts).
       maintenanceRecovered();
-      if (res.resultCode && res.resultCode !== 'ok') throw new GatewayError(res.resultCode);
+      if (res.resultCode && res.resultCode !== 'ok') {
+        if (res.resultCode === UPDATE_REQUIRED) reportUpdateRequired();
+        throw new GatewayError(res.resultCode);
+      }
       return res.payload;
     }
   }
@@ -363,7 +375,9 @@ export function createTransport(baseUrl: string): GatewayClient {
           if (!ctrl.signal.aborted) {
             const maintMs = maintenanceRetryMs(e);
             if (maintMs !== null) reportMaintenance(maintMs);
-            onError?.(toGatewayError(e));
+            const err = toGatewayError(e);
+            if (err.code === UPDATE_REQUIRED) reportUpdateRequired();
+            onError?.(err);
           }
         }
       })();