Stage 10: admin console & dictionary ops (complaint review, hot-reload, broadcasts)

Server-rendered admin console in the backend at /_gm (internal/adminconsole),
fronted on the gateway's public listener by Basic-Auth + a verbatim reverse proxy
(mounted on the edge mux below the h2c wrap). A same-origin check guards its POSTs;
no operator identity is tracked. This supersedes the Stage 6 gateway-fronts-
/api/v1/admin model: GATEWAY_ADMIN_ADDR and the backend /api/v1/admin ping are
dropped and gateway/internal/admin is repurposed to the verbatim proxy.

- Complaints: migration 00008 (+ jetgen) adds disposition/resolution_note/
  resolved_at/applied_in_version + the deferred status CHECK; resolution feeds a
  query-derived pending dictionary-change pipeline (marked applied after a reload).
- Dictionary hot-reload: per-version subdir BACKEND_DICT_DIR/<version>/ via the new
  Registry.LoadAvailable; engine.OpenWithVersions restores resident versions on
  restart. Partially addresses TODO-2.
- Broadcasts: a backend Telegram-connector client (internal/connector,
  BACKEND_CONNECTOR_ADDR) for SendToUser / SendToGameChannel (discharges the Stage 9
  forward-note).
- Admin reads: account.ListAccounts/CountAccounts/Identities and
  game.ListGames/CountGames/GameByID/ListComplaints/GetComplaint/CountComplaints/
  ResolveComplaint/DictionaryChanges/MarkChangesApplied.
- Tests: adminconsole render, engine reload, same-origin guard, gateway verbatim
  proxy + h2c console mount, inttest complaint pipeline + list/count + /_gm console.
- Docs: PLAN (Stage 10 done + refinements + TODO-2), ARCHITECTURE §1/§5/§6/§12/§13,
  FUNCTIONAL (+_ru), TESTING, backend/gateway READMEs.

backend/cmd/backend/main.go

@@ -19,6 +19,7 @@ import (
 
 	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/config"
+	"scrabble/backend/internal/connector"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
@@ -92,7 +93,7 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	}
 	logger.Info("database migrations applied")
 
-	registry, err := engine.Open(cfg.Game.DictDir, cfg.Game.DictVersion)
+	registry, err := engine.OpenWithVersions(cfg.Game.DictDir, cfg.Game.DictVersion)
 	if err != nil {
 		return fmt.Errorf("load dictionaries: %w", err)
 	}
@@ -101,6 +102,19 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		zap.String("dir", cfg.Game.DictDir),
 		zap.String("version", cfg.Game.DictVersion))
 
+	// Stage 10 admin console: an optional backend client to the Telegram connector
+	// side-service for operator broadcasts. Unset (BACKEND_CONNECTOR_ADDR empty)
+	// leaves broadcasts disabled — the console shows a "not configured" notice.
+	var conn *connector.Client
+	if cfg.ConnectorAddr != "" {
+		conn, err = connector.New(cfg.ConnectorAddr)
+		if err != nil {
+			return fmt.Errorf("dial connector: %w", err)
+		}
+		defer func() { _ = conn.Close() }()
+		logger.Info("connector client ready", zap.String("addr", cfg.ConnectorAddr))
+	}
+
 	sessions := session.NewService(session.NewStore(db), session.NewCache())
 	if err := sessions.Warm(ctx); err != nil {
 		return fmt.Errorf("warm session cache: %w", err)
@@ -156,6 +170,9 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		Matchmaker:    matchmaker,
 		Invitations:   invitations,
 		Emails:        emails,
+		Registry:      registry,
+		DictDir:       cfg.Game.DictDir,
+		Connector:     conn,
 	})
 	pushSrv := pushgrpc.NewServer(cfg.GRPCAddr, hub, logger)