Stage 10: admin console & dictionary ops (complaint review, hot-reload, broadcasts)

Server-rendered admin console in the backend at /_gm (internal/adminconsole),
fronted on the gateway's public listener by Basic-Auth + a verbatim reverse proxy
(mounted on the edge mux below the h2c wrap). A same-origin check guards its POSTs;
no operator identity is tracked. This supersedes the Stage 6 gateway-fronts-
/api/v1/admin model: GATEWAY_ADMIN_ADDR and the backend /api/v1/admin ping are
dropped and gateway/internal/admin is repurposed to the verbatim proxy.

- Complaints: migration 00008 (+ jetgen) adds disposition/resolution_note/
  resolved_at/applied_in_version + the deferred status CHECK; resolution feeds a
  query-derived pending dictionary-change pipeline (marked applied after a reload).
- Dictionary hot-reload: per-version subdir BACKEND_DICT_DIR/<version>/ via the new
  Registry.LoadAvailable; engine.OpenWithVersions restores resident versions on
  restart. Partially addresses TODO-2.
- Broadcasts: a backend Telegram-connector client (internal/connector,
  BACKEND_CONNECTOR_ADDR) for SendToUser / SendToGameChannel (discharges the Stage 9
  forward-note).
- Admin reads: account.ListAccounts/CountAccounts/Identities and
  game.ListGames/CountGames/GameByID/ListComplaints/GetComplaint/CountComplaints/
  ResolveComplaint/DictionaryChanges/MarkChangesApplied.
- Tests: adminconsole render, engine reload, same-origin guard, gateway verbatim
  proxy + h2c console mount, inttest complaint pipeline + list/count + /_gm console.
- Docs: PLAN (Stage 10 done + refinements + TODO-2), ARCHITECTURE §1/§5/§6/§12/§13,
  FUNCTIONAL (+_ru), TESTING, backend/gateway READMEs.

backend/internal/config/config.go

@@ -38,6 +38,10 @@ type Config struct {
 	// SMTP configures the email relay used for confirm-codes. An empty Host
 	// selects the development log mailer (the code is logged, not sent).
 	SMTP account.SMTPConfig
+	// ConnectorAddr is the gRPC address of the Telegram platform connector
+	// side-service, used by the admin console to send operator broadcasts. Empty
+	// disables broadcasts (the admin broadcast actions report "not configured").
+	ConnectorAddr string
 }
 
 // Defaults applied when the corresponding environment variable is unset.
@@ -103,15 +107,16 @@ func Load() (Config, error) {
 	}
 
 	c := Config{
-		HTTPAddr:  envOr("BACKEND_HTTP_ADDR", defaultHTTPAddr),
-		GRPCAddr:  envOr("BACKEND_GRPC_ADDR", defaultGRPCAddr),
-		LogLevel:  envOr("BACKEND_LOG_LEVEL", defaultLogLevel),
-		Postgres:  pg,
-		Telemetry: tel,
-		Game:      gm,
-		Lobby:     lb,
-		Robot:     rb,
-		SMTP:      smtp,
+		HTTPAddr:      envOr("BACKEND_HTTP_ADDR", defaultHTTPAddr),
+		GRPCAddr:      envOr("BACKEND_GRPC_ADDR", defaultGRPCAddr),
+		LogLevel:      envOr("BACKEND_LOG_LEVEL", defaultLogLevel),
+		Postgres:      pg,
+		Telemetry:     tel,
+		Game:          gm,
+		Lobby:         lb,
+		Robot:         rb,
+		SMTP:          smtp,
+		ConnectorAddr: os.Getenv("BACKEND_CONNECTOR_ADDR"),
 	}
 	if err := c.validate(); err != nil {
 		return Config{}, err