R2: load-test harness + contour resource observability

New scrabble/loadtest module (the pre-release stress harness): seeds 1000 guest +
10000 durable accounts with pre-created sessions directly in Postgres (token hash
matches backend/internal/session), drives virtual players through the edge protocol
(real 2-4p games assembled via invitations, mid-ranked legal moves generated locally
by the embedded scrabble-solver — the edge carries no board, so the client replays
history), plus nudge/chat/check-word/draft/profile/stats and a gateway-hammer that
verifies the rate limiter. Prints a trip-report summary (per-op latency percentiles,
result codes, live-event tally). Go unit tests cover the pure pieces; the DAWG-backed
move test runs under BACKEND_DICT_DIR.

Contour: add cAdvisor + postgres_exporter + a 'Scrabble - Resources' Grafana
dashboard and the two Prometheus scrape jobs, for the R2/R7 stress-run resource
baseline.

CI: gate ./loadtest/... (path filter + vet/build/test). Docs: TESTING, ARCHITECTURE,
project CLAUDE repo layout.

deploy/docker-compose.yml

@@ -225,6 +225,38 @@ services:
       - grafana-data:/var/lib/grafana
     networks: [internal]
 
+  # cAdvisor exports per-container resource metrics (CPU / memory / network / disk)
+  # for the R2/R7 stress runs' resource baseline. Prometheus scrapes it at :8080
+  # over the internal network. It needs read access to the host's cgroup and
+  # container state; --docker_only trims non-container cgroup series.
+  cadvisor:
+    container_name: scrabble-cadvisor
+    image: gcr.io/cadvisor/cadvisor:v0.49.1
+    restart: unless-stopped
+    privileged: true
+    command: ["--docker_only=true", "--housekeeping_interval=15s"]
+    devices:
+      - /dev/kmsg
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+      - /dev/disk/:/dev/disk:ro
+    networks: [internal]
+
+  # postgres_exporter exports Postgres server metrics (connections, cache hit ratio,
+  # transactions, database size). Prometheus scrapes it at :9187. The DSN reuses the
+  # contour Postgres credentials; sslmode=disable on the internal network.
+  postgres_exporter:
+    container_name: scrabble-postgres-exporter
+    image: prometheuscommunity/postgres-exporter:v0.16.0
+    restart: unless-stopped
+    depends_on: [postgres]
+    environment:
+      DATA_SOURCE_NAME: postgresql://${POSTGRES_USER:-scrabble}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-scrabble}?sslmode=disable
+    networks: [internal]
+
 networks:
   internal:
     name: scrabble-internal