feat(offer): live catalog price list in the public offer, served by the render sidecar

Robokassa moderation requires the public offer to list every digital good with
its price. Move /offer/ off the static landing container to the render sidecar:
it splices the live catalog price list (§4.4) into the owner-edited
ui/legal/offer_ru.md and renders it with the shared ui/src/lib/offer.ts — one
renderer, no drift, always matching the current catalog with no redeploy.

- backend: /api/v1/internal/offer/pricing (internal, off the edge allow-list)
  projects the active catalog into two markdown tables — chip packs priced per
  rail (roubles / VK votes / Telegram Stars) and chip-priced values — through
  payments.Money so no float reaches the page. Cached in memory: warmed at boot,
  marked stale on every catalog mutation, so a served render issues no query.
- renderer: GET /offer/ fetches the tables and substitutes them at the
  <#pricing_template#> marker, then renders; offer_ru.md is baked into the image
  and marked is bundled from ui. GET /offer -> 301. Only /offer/ is edge-exposed.
- caddy: route /offer/ to the sidecar; drop the now-dead landing /offer/
  handlers and the vite emit-offer plugin.
- offer: fill §4.3 (the chip-payment wording) and drop the in-page back link.
- landing footer: a feedback link (the offer's Telegram contact) beside the
  offer link.
- docs (ARCHITECTURE, FUNCTIONAL +_ru, renderer README), CI /offer/ probe,
  unit + integration + node tests.

backend/internal/payments/catalog_admin.go

@@ -153,7 +153,11 @@ func (s *Service) CreateProduct(ctx context.Context, in ProductInput, active boo
 	if err := validateProduct(in, active); err != nil {
 		return uuid.Nil, err
 	}
-	return s.store.createProduct(ctx, in, active, s.clock())
+	id, err := s.store.createProduct(ctx, in, active, s.clock())
+	if err == nil {
+		s.markOfferStale()
+	}
+	return id, err
 }
 
 // UpdateProduct validates and replaces a product's title, atoms and prices. An active product must
@@ -166,7 +170,11 @@ func (s *Service) UpdateProduct(ctx context.Context, id uuid.UUID, in ProductInp
 	if err := validateProduct(in, active); err != nil {
 		return err
 	}
-	return s.store.updateProduct(ctx, id, in, s.clock())
+	if err := s.store.updateProduct(ctx, id, in, s.clock()); err != nil {
+		return err
+	}
+	s.markOfferStale()
+	return nil
 }
 
 // SetProductActive archives (active=false) or unarchives a product. Unarchiving revalidates the
@@ -181,11 +189,19 @@ func (s *Service) SetProductActive(ctx context.Context, id uuid.UUID, active boo
 			return err
 		}
 	}
-	return s.store.setProductActive(ctx, id, active, s.clock())
+	if err := s.store.setProductActive(ctx, id, active, s.clock()); err != nil {
+		return err
+	}
+	s.markOfferStale()
+	return nil
 }
 
 // DeleteProduct hard-deletes a product only when it has never been transacted (no order or ledger
 // row references it); otherwise it returns ErrProductTransacted and the caller archives instead.
 func (s *Service) DeleteProduct(ctx context.Context, id uuid.UUID) error {
-	return s.store.deleteProduct(ctx, id)
+	if err := s.store.deleteProduct(ctx, id); err != nil {
+		return err
+	}
+	s.markOfferStale()
+	return nil
 }