Stage 10: admin console & dictionary ops (complaint review, hot-reload, broadcasts)

Server-rendered admin console in the backend at /_gm (internal/adminconsole),
fronted on the gateway's public listener by Basic-Auth + a verbatim reverse proxy
(mounted on the edge mux below the h2c wrap). A same-origin check guards its POSTs;
no operator identity is tracked. This supersedes the Stage 6 gateway-fronts-
/api/v1/admin model: GATEWAY_ADMIN_ADDR and the backend /api/v1/admin ping are
dropped and gateway/internal/admin is repurposed to the verbatim proxy.

- Complaints: migration 00008 (+ jetgen) adds disposition/resolution_note/
  resolved_at/applied_in_version + the deferred status CHECK; resolution feeds a
  query-derived pending dictionary-change pipeline (marked applied after a reload).
- Dictionary hot-reload: per-version subdir BACKEND_DICT_DIR/<version>/ via the new
  Registry.LoadAvailable; engine.OpenWithVersions restores resident versions on
  restart. Partially addresses TODO-2.
- Broadcasts: a backend Telegram-connector client (internal/connector,
  BACKEND_CONNECTOR_ADDR) for SendToUser / SendToGameChannel (discharges the Stage 9
  forward-note).
- Admin reads: account.ListAccounts/CountAccounts/Identities and
  game.ListGames/CountGames/GameByID/ListComplaints/GetComplaint/CountComplaints/
  ResolveComplaint/DictionaryChanges/MarkChangesApplied.
- Tests: adminconsole render, engine reload, same-origin guard, gateway verbatim
  proxy + h2c console mount, inttest complaint pipeline + list/count + /_gm console.
- Docs: PLAN (Stage 10 done + refinements + TODO-2), ARCHITECTURE §1/§5/§6/§12/§13,
  FUNCTIONAL (+_ru), TESTING, backend/gateway READMEs.

gateway/internal/connectsrv/console_mount_test.go

@@ -0,0 +1,45 @@
+package connectsrv_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"scrabble/gateway/internal/connectsrv"
+)
+
+// TestHTTPHandlerMountsAdminConsole verifies the admin proxy is reachable at /_gm/
+// through the h2c-wrapped edge mux when configured.
+func TestHTTPHandlerMountsAdminConsole(t *testing.T) {
+	stub := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusTeapot)
+	})
+	srv := connectsrv.NewServer(connectsrv.Deps{AdminProxy: stub})
+	front := httptest.NewServer(srv.HTTPHandler())
+	defer front.Close()
+
+	resp, err := http.Get(front.URL + "/_gm/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusTeapot {
+		t.Fatalf("/_gm status = %d, want 418 (routed to the admin proxy)", resp.StatusCode)
+	}
+}
+
+// TestHTTPHandlerNoAdminConsole verifies /_gm is not served when no proxy is set.
+func TestHTTPHandlerNoAdminConsole(t *testing.T) {
+	srv := connectsrv.NewServer(connectsrv.Deps{})
+	front := httptest.NewServer(srv.HTTPHandler())
+	defer front.Close()
+
+	resp, err := http.Get(front.URL + "/_gm/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("/_gm status = %d, want 404 (no admin proxy)", resp.StatusCode)
+	}
+}

gateway/internal/connectsrv/server.go

@@ -32,12 +32,13 @@ const heartbeatKind = "heartbeat"
 
 // Server implements edgev1connect.GatewayHandler.
 type Server struct {
-	registry  *transcode.Registry
-	sessions  *session.Cache
-	limiter   *ratelimit.Limiter
-	hub       *push.Hub
-	heartbeat time.Duration
-	log       *zap.Logger
+	registry   *transcode.Registry
+	sessions   *session.Cache
+	limiter    *ratelimit.Limiter
+	hub        *push.Hub
+	heartbeat  time.Duration
+	log        *zap.Logger
+	adminProxy http.Handler
 
 	publicPolicy ratelimit.Policy
 	userPolicy   ratelimit.Policy
@@ -46,13 +47,14 @@ type Server struct {
 
 // Deps carries the Server's dependencies.
 type Deps struct {
-	Registry  *transcode.Registry
-	Sessions  *session.Cache
-	Limiter   *ratelimit.Limiter
-	Hub       *push.Hub
-	RateLimit config.RateLimitConfig
-	Heartbeat time.Duration
-	Logger    *zap.Logger
+	Registry   *transcode.Registry
+	Sessions   *session.Cache
+	Limiter    *ratelimit.Limiter
+	Hub        *push.Hub
+	RateLimit  config.RateLimitConfig
+	Heartbeat  time.Duration
+	Logger     *zap.Logger
+	AdminProxy http.Handler
 }
 
 // NewServer constructs the edge service.
@@ -68,6 +70,7 @@ func NewServer(d Deps) *Server {
 		hub:          d.Hub,
 		heartbeat:    d.Heartbeat,
 		log:          log,
+		adminProxy:   d.AdminProxy,
 		publicPolicy: ratelimit.PerMinute(d.RateLimit.PublicPerMinute, d.RateLimit.PublicBurst),
 		userPolicy:   ratelimit.PerMinute(d.RateLimit.UserPerMinute, d.RateLimit.UserBurst),
 		emailPolicy:  ratelimit.Per(d.RateLimit.EmailPer10Min, 10*time.Minute, d.RateLimit.EmailBurst),
@@ -79,6 +82,12 @@ func (s *Server) HTTPHandler() http.Handler {
 	mux := http.NewServeMux()
 	path, h := edgev1connect.NewGatewayHandler(s)
 	mux.Handle(path, h)
+	if s.adminProxy != nil {
+		// The admin console (backend /_gm) is served on the public listener behind
+		// the proxy's Basic-Auth, mounted below the h2c wrap so the Connect edge keeps
+		// working over h2c (docs/ARCHITECTURE.md §12).
+		mux.Handle("/_gm/", s.adminProxy)
+	}
 	return h2c.NewHandler(mux, &http2.Server{})
 }