feat(offer): live catalog price list in the public offer, served by the render sidecar

Robokassa moderation requires the public offer to list every digital good with
its price. Move /offer/ off the static landing container to the render sidecar:
it splices the live catalog price list (§4.4) into the owner-edited
ui/legal/offer_ru.md and renders it with the shared ui/src/lib/offer.ts — one
renderer, no drift, always matching the current catalog with no redeploy.

- backend: /api/v1/internal/offer/pricing (internal, off the edge allow-list)
  projects the active catalog into two markdown tables — chip packs priced per
  rail (roubles / VK votes / Telegram Stars) and chip-priced values — through
  payments.Money so no float reaches the page. Cached in memory: warmed at boot,
  marked stale on every catalog mutation, so a served render issues no query.
- renderer: GET /offer/ fetches the tables and substitutes them at the
  <#pricing_template#> marker, then renders; offer_ru.md is baked into the image
  and marked is bundled from ui. GET /offer -> 301. Only /offer/ is edge-exposed.
- caddy: route /offer/ to the sidecar; drop the now-dead landing /offer/
  handlers and the vite emit-offer plugin.
- offer: fill §4.3 (the chip-payment wording) and drop the in-page back link.
- landing footer: a feedback link (the offer's Telegram contact) beside the
  offer link.
- docs (ARCHITECTURE, FUNCTIONAL +_ru, renderer README), CI /offer/ probe,
  unit + integration + node tests.

.gitea/workflows/ci.yaml

@@ -510,15 +510,20 @@ jobs:
       - name: Probe the /offer/ public offer page is served
         run: |
           set -u
-          # /offer/ is a static page baked into the landing image (rendered from
-          # ui/legal/offer_ru.md). If the landing Caddyfile stops routing it, the request
-          # silently falls through to the landing shell (also 200) — so assert offer-specific
-          # content, never just the status.
+          # /offer/ is rendered by the render sidecar: it splices the live catalog price list
+          # (fetched from the backend's internal endpoint) into the committed ui/legal/offer_ru.md.
+          # If the @offer caddy route is missing, the request falls to the landing shell (also 200),
+          # and if the backend fetch fails the sidecar returns 502 — so assert offer-specific content
+          # (the seller INN, §11) AND that the pricing marker was substituted (proves the fetch +
+          # splice ran), never just the status. Data-independent: an empty catalog still substitutes
+          # the marker with nothing, so "pricing_template" must be absent either way.
           out="$(docker run --rm --network edge alpine:3.20 wget -q -O - http://scrabble/offer/ 2>&1 || true)"
-          if echo "$out" | grep -q "290210610742"; then
-            echo "ok: /offer/ serves the public offer page"
+          if echo "$out" | grep -q "290210610742" && ! echo "$out" | grep -q "pricing_template"; then
+            echo "ok: /offer/ serves the rendered offer with the price list spliced in"
           else
-            echo "FAIL: /offer/ did not serve the offer page (fell through to the landing shell?)"
+            echo "FAIL: /offer/ did not serve the rendered offer (route fell through, or the price splice failed)"
+            docker logs --tail 50 scrabble-renderer || true
+            docker logs --tail 50 scrabble-backend || true
             docker logs --tail 50 scrabble-landing || true
             exit 1
           fi