feat(gateway,ui): client-version gate — turn away too-old builds

Introduce a minimum-supported-client gate so a future incompatible wire change
can turn away installed builds too old to speak it, cleanly, instead of letting
them crash on decode. It rides the outermost stable layer (an HTTP header), never
the FlatBuffers payload.

Gateway:
- New internal/clientver: dependency-free parse + compare of the leading
  MAJOR.MINOR.PATCH (a git-describe suffix is tolerated).
- GATEWAY_MIN_CLIENT_VERSION config (empty => gate dormant; validated at load).
- connectsrv checks the X-Client-Version header before decoding the payload:
  Execute returns result_code="update_required" (before the registry lookup),
  Subscribe returns FailedPrecondition. It fails open on an absent or garbled
  header — the header is a client-controlled compatibility signal, not an access
  control.

Client:
- Attach X-Client-Version on every call.
- A terminal update.svelte.ts store + a non-dismissable UpdateOverlay (native
  opens VITE_STORE_URL, web reloads); retry.ts maps FailedPrecondition to the
  update_required sentinel; a mock __update hook drives the e2e.

Wire-additive and contour-safe: no FBS/proto regen, no schema migration; the gate
stays dormant until GATEWAY_MIN_CLIENT_VERSION is deliberately set, so web / VK /
Telegram behaviour is unchanged. The silent reconciliation seam is deferred to the
offline-first work (its only caller). Tests: Go clientver/config/connectsrv gate
tests, retry.test.ts, Playwright update.spec.ts.

ui/src/lib/update.svelte.ts

@@ -0,0 +1,26 @@
+// Global "client too old" signal. `active` latches true the first time the gateway answers a
+// user-initiated online call with the update_required sentinel — the HTTP-header version gate the
+// edge checks before decoding the payload (docs/ARCHITECTURE.md §2). It is terminal: unlike the
+// maintenance signal there is no self-clearing poll, because an installed build cannot become
+// compatible without an actual update. A non-dismissable overlay (UpdateOverlay.svelte) then covers
+// the app; its one action sends the user to the store (native) or reloads (web). Offline play never
+// trips it — the network kill switch refuses the call before it leaves the device.
+
+/** UPDATE_REQUIRED is the stable sentinel the gateway returns (the Execute result_code, and the
+ *  GatewayError code the Subscribe FailedPrecondition maps to) for a client too old to be served. */
+export const UPDATE_REQUIRED = 'update_required';
+
+let required = $state(false);
+
+export const updateRequired = {
+  /** active is true once a foreground online call has been refused as too old. Terminal. */
+  get active(): boolean {
+    return required;
+  },
+};
+
+/** reportUpdateRequired latches the terminal "update required" overlay. The transport calls it when
+ *  a foreground call returns the update_required sentinel; idempotent. */
+export function reportUpdateRequired(): void {
+  required = true;
+}