Stage 8 polish: profile validation, finished-game UI, badge + Safari fixes

Owner-review follow-up on the Stage 8 branch:
- Friend code is copyable (📋 + toast). The lobby notification badge is fixed —
  it had inherited the hamburger-bar style — into a proper round count dot.
- Safari: min-width:0 on flex text inputs (friend code, profile, chat) so they
  shrink instead of pushing the adjacent button off-screen.
- Profile editing is validated on both the UI and the backend: display-name format
  (letters joined by single space/./_ separators, no leading/trailing/adjacent
  separators, <=32 runes), a UTC-offset timezone picker (account.ResolveZone parses
  ±HH:MM or a legacy IANA name), a 10-minute away grid capped at 12h (wrap-aware),
  and email format; Save is disabled and invalid fields red-bordered until valid.
  Language stays in Settings.
- In a game, an "add to friends" menu item flips to a disabled "request sent"; chat
  send/nudge became ⬆️/🛎️ icon buttons.
- A finished game drops its last-word highlight, hides Check word / Drop game,
  disables zoom, and draws an inert (greyed) footer instead of hiding it.

Tests: account validators (name/away/zone), UI profileValidation, e2e for the
finished-game footer/menu and the copy control. Docs (PLAN, ARCHITECTURE,
FUNCTIONAL +ru, UI_DESIGN) updated for the display-name rule, UTC-offset timezone
and the 12h away window.

ui/src/lib/i18n/en.ts

@@ -178,6 +178,8 @@ export const en = {
   'friends.enterCode': 'Have a code? Add a friend',
   'friends.codePlaceholder': '6-digit code',
   'friends.redeem': 'Add',
+  'friends.copy': 'Copy',
+  'friends.codeCopied': 'Code copied.',
   'friends.added': 'Added {name}.',
   'friends.blockedList': 'Blocked players',
   'friends.unblock': 'Unblock',
@@ -212,6 +214,7 @@ export const en = {
 
   'game.exportGcg': 'Export GCG',
   'game.gcgActiveOnly': 'Available once the game is finished.',
+  'game.requestSent': 'Request sent',
 
   'time.minutes': '{n} min',
   'time.hours': '{n} h',

ui/src/lib/i18n/ru.ts

@@ -179,6 +179,8 @@ export const ru: Record<MessageKey, string> = {
   'friends.enterCode': 'Есть код? Добавить друга',
   'friends.codePlaceholder': 'Код из 6 цифр',
   'friends.redeem': 'Добавить',
+  'friends.copy': 'Копировать',
+  'friends.codeCopied': 'Код скопирован.',
   'friends.added': 'Добавлен(а) {name}.',
   'friends.blockedList': 'Заблокированные',
   'friends.unblock': 'Разблокировать',
@@ -213,6 +215,7 @@ export const ru: Record<MessageKey, string> = {
 
   'game.exportGcg': 'Экспорт GCG',
   'game.gcgActiveOnly': 'Доступно после завершения игры.',
+  'game.requestSent': 'Запрос отправлен',
 
   'time.minutes': '{n} мин',
   'time.hours': '{n} ч',

ui/src/lib/profileValidation.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { awayDurationOk, browserOffset, isOffsetZone, validDisplayName, validEmail } from './profileValidation';
+
+describe('validDisplayName', () => {
+  it.each([
+    ['Kaya', true],
+    ['Кая', true],
+    ['Name_P. Last', true],
+    ['Mr.Smith', true],
+    ['Mr. Smith', true],
+    ['  Kaya  ', true],
+    ['Name P._Last', false],
+    ['Name  Last', false],
+    ['_Name', false],
+    ['Name.', false],
+    ['Name2', false],
+    ['', false],
+    ['a'.repeat(33), false],
+  ])('%s -> %s', (name, ok) => {
+    expect(validDisplayName(name)).toBe(ok);
+  });
+});
+
+describe('validEmail', () => {
+  it('accepts a normal address', () => expect(validEmail('you@example.com')).toBe(true));
+  it('rejects a missing domain', () => expect(validEmail('you@')).toBe(false));
+  it('rejects spaces', () => expect(validEmail('a b@x.com')).toBe(false));
+});
+
+describe('awayDurationOk', () => {
+  it.each([
+    ['22:00', '06:00', true],
+    ['00:00', '12:00', true],
+    ['08:00', '21:00', false],
+    ['07:00', '07:00', true],
+    ['20:00', '09:00', false],
+  ])('%s-%s -> %s', (s, e, ok) => expect(awayDurationOk(s, e)).toBe(ok));
+});
+
+describe('timezone helpers', () => {
+  it('detects offset zones', () => {
+    expect(isOffsetZone('+03:00')).toBe(true);
+    expect(isOffsetZone('Europe/Moscow')).toBe(false);
+  });
+  it('formats the browser offset as ±HH:MM', () => {
+    expect(browserOffset()).toMatch(/^[+-]\d{2}:\d{2}$/);
+  });
+});

ui/src/lib/profileValidation.ts

@@ -0,0 +1,79 @@
+// Profile-edit validation, mirroring the backend (account/profile.go,
+// account/timezone.go) so the form can disable Save and flag fields before a round
+// trip. Pure and unit-tested.
+
+/** maxDisplayName caps the editable display name in runes. */
+export const maxDisplayName = 32;
+
+/** maxAwayMinutes bounds the daily away window's length (12 h). */
+export const maxAwayMinutes = 12 * 60;
+
+// Unicode letters joined by single space / "." / "_" separators, where a "." or "_"
+// may be followed by a single space. No leading/trailing separator and no adjacent
+// separators except "<dot|underscore> <space>". Same rule as the Go displayNameRe.
+const displayNameRe = /^\p{L}+(?:(?:[._] ?| )\p{L}+)*$/u;
+
+/** displayNameError returns true when the trimmed name is a valid display name. */
+export function validDisplayName(raw: string): boolean {
+  const name = raw.trim();
+  return name.length > 0 && [...name].length <= maxDisplayName && displayNameRe.test(name);
+}
+
+// A pragmatic email check (the backend re-validates with net/mail). Rejects spaces
+// and requires a local part, an @, and a dotted domain.
+const emailRe = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+/** validEmail reports whether email is a plausible address. */
+export function validEmail(email: string): boolean {
+  return emailRe.test(email.trim());
+}
+
+/** toMinutes parses an "HH:MM" time-of-day into minutes since midnight, or null. */
+export function toMinutes(hhmm: string): number | null {
+  const m = /^(\d{2}):(\d{2})$/.exec(hhmm);
+  if (!m) return null;
+  const h = Number(m[1]);
+  const min = Number(m[2]);
+  if (h > 23 || min > 59) return null;
+  return h * 60 + min;
+}
+
+/** awayDurationOk reports whether the away window (wrapping midnight) is <= 12 h. */
+export function awayDurationOk(start: string, end: string): boolean {
+  const s = toMinutes(start);
+  const e = toMinutes(end);
+  if (s === null || e === null) return false;
+  let d = e - s;
+  if (d < 0) d += 24 * 60;
+  return d <= maxAwayMinutes;
+}
+
+/** The real-world set of unique UTC offsets, for the timezone dropdown. */
+export const timezoneOffsets: string[] = [
+  '-12:00', '-11:00', '-10:00', '-09:30', '-09:00', '-08:00', '-07:00', '-06:00',
+  '-05:00', '-04:00', '-03:30', '-03:00', '-02:00', '-01:00', '+00:00', '+01:00',
+  '+02:00', '+03:00', '+03:30', '+04:00', '+04:30', '+05:00', '+05:30', '+05:45',
+  '+06:00', '+06:30', '+07:00', '+08:00', '+08:45', '+09:00', '+09:30', '+10:00',
+  '+10:30', '+11:00', '+12:00', '+12:45', '+13:00', '+14:00',
+];
+
+/** isOffsetZone reports whether a stored timezone is a "±HH:MM" offset. */
+export function isOffsetZone(tz: string): boolean {
+  return /^[+-]\d{2}:\d{2}$/.test(tz);
+}
+
+/** browserOffset returns the client's current UTC offset as "±HH:MM". */
+export function browserOffset(): string {
+  const mins = -new Date().getTimezoneOffset(); // getTimezoneOffset is minutes behind UTC
+  const sign = mins < 0 ? '-' : '+';
+  const abs = Math.abs(mins);
+  const hh = String(Math.floor(abs / 60)).padStart(2, '0');
+  const mm = String(abs % 60).padStart(2, '0');
+  return `${sign}${hh}:${mm}`;
+}
+
+/** Hour options "00".."23" for the away-window pickers. */
+export const awayHours: string[] = Array.from({ length: 24 }, (_, i) => String(i).padStart(2, '0'));
+
+/** Minute options on a 10-minute step. */
+export const awayMinutes: string[] = ['00', '10', '20', '30', '40', '50'];