Stage 10: admin console & dictionary ops (complaint review, hot-reload, broadcasts)

Server-rendered admin console in the backend at /_gm (internal/adminconsole),
fronted on the gateway's public listener by Basic-Auth + a verbatim reverse proxy
(mounted on the edge mux below the h2c wrap). A same-origin check guards its POSTs;
no operator identity is tracked. This supersedes the Stage 6 gateway-fronts-
/api/v1/admin model: GATEWAY_ADMIN_ADDR and the backend /api/v1/admin ping are
dropped and gateway/internal/admin is repurposed to the verbatim proxy.

- Complaints: migration 00008 (+ jetgen) adds disposition/resolution_note/
  resolved_at/applied_in_version + the deferred status CHECK; resolution feeds a
  query-derived pending dictionary-change pipeline (marked applied after a reload).
- Dictionary hot-reload: per-version subdir BACKEND_DICT_DIR/<version>/ via the new
  Registry.LoadAvailable; engine.OpenWithVersions restores resident versions on
  restart. Partially addresses TODO-2.
- Broadcasts: a backend Telegram-connector client (internal/connector,
  BACKEND_CONNECTOR_ADDR) for SendToUser / SendToGameChannel (discharges the Stage 9
  forward-note).
- Admin reads: account.ListAccounts/CountAccounts/Identities and
  game.ListGames/CountGames/GameByID/ListComplaints/GetComplaint/CountComplaints/
  ResolveComplaint/DictionaryChanges/MarkChangesApplied.
- Tests: adminconsole render, engine reload, same-origin guard, gateway verbatim
  proxy + h2c console mount, inttest complaint pipeline + list/count + /_gm console.
- Docs: PLAN (Stage 10 done + refinements + TODO-2), ARCHITECTURE §1/§5/§6/§12/§13,
  FUNCTIONAL (+_ru), TESTING, backend/gateway READMEs.

backend/internal/server/server.go

@@ -18,6 +18,9 @@ import (
 	"go.uber.org/zap"
 
 	"scrabble/backend/internal/account"
+	"scrabble/backend/internal/adminconsole"
+	"scrabble/backend/internal/connector"
+	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
 	"scrabble/backend/internal/session"
@@ -55,6 +58,15 @@ type Deps struct {
 	Matchmaker  *lobby.Matchmaker
 	Invitations *lobby.InvitationService
 	Emails      *account.EmailService
+	// Registry holds the resident dictionaries; the admin console (Stage 10) reads
+	// its versions and hot-reloads new ones. DictDir is the dictionary directory a
+	// reload reads a version subdirectory from. A nil Registry disables the console.
+	Registry *engine.Registry
+	DictDir  string
+	// Connector is the backend's Telegram connector client for operator broadcasts;
+	// nil when BACKEND_CONNECTOR_ADDR is unset (broadcasts show a "not configured"
+	// notice).
+	Connector *connector.Client
 }
 
 // Server owns the gin engine, the underlying HTTP server and the readiness
@@ -73,11 +85,14 @@ type Server struct {
 	matchmaker  *lobby.Matchmaker
 	invitations *lobby.InvitationService
 	emails      *account.EmailService
+	registry    *engine.Registry
+	dictDir     string
+	connector   *connector.Client
+	console     *adminconsole.Renderer
 
 	public   *gin.RouterGroup
 	user     *gin.RouterGroup
 	internal *gin.RouterGroup
-	admin    *gin.RouterGroup
 }
 
 // New returns a Server that will listen on addr. It installs the recovery and
@@ -109,11 +124,15 @@ func New(addr string, deps Deps) *Server {
 		matchmaker:    deps.Matchmaker,
 		invitations:   deps.Invitations,
 		emails:        deps.Emails,
+		registry:      deps.Registry,
+		dictDir:       deps.DictDir,
+		connector:     deps.Connector,
 		http:          &http.Server{Addr: addr, Handler: engine},
 	}
 	s.registerProbes(engine)
 	s.registerAPIGroups(engine)
 	s.registerRoutes()
+	s.registerConsole(engine)
 	return s
 }
 
@@ -153,7 +172,6 @@ func (s *Server) registerAPIGroups(engine *gin.Engine) {
 	s.user = v1.Group("/user")
 	s.user.Use(RequireUserID())
 	s.internal = v1.Group("/internal")
-	s.admin = v1.Group("/admin")
 }
 
 // PublicGroup returns the unauthenticated public route group.
@@ -165,9 +183,6 @@ func (s *Server) UserGroup() *gin.RouterGroup { return s.user }
 // InternalGroup returns the gateway-facing internal route group.
 func (s *Server) InternalGroup() *gin.RouterGroup { return s.internal }
 
-// AdminGroup returns the admin route group (authenticated at the gateway).
-func (s *Server) AdminGroup() *gin.RouterGroup { return s.admin }
-
 // Social returns the social domain service for the handlers added in Stage 6.
 func (s *Server) Social() *social.Service { return s.social }