feat(offer): live catalog price list in the public offer, served by the render sidecar

Robokassa moderation requires the public offer to list every digital good with
its price. Move /offer/ off the static landing container to the render sidecar:
it splices the live catalog price list (§4.4) into the owner-edited
ui/legal/offer_ru.md and renders it with the shared ui/src/lib/offer.ts — one
renderer, no drift, always matching the current catalog with no redeploy.

- backend: /api/v1/internal/offer/pricing (internal, off the edge allow-list)
  projects the active catalog into two markdown tables — chip packs priced per
  rail (roubles / VK votes / Telegram Stars) and chip-priced values — through
  payments.Money so no float reaches the page. Cached in memory: warmed at boot,
  marked stale on every catalog mutation, so a served render issues no query.
- renderer: GET /offer/ fetches the tables and substitutes them at the
  <#pricing_template#> marker, then renders; offer_ru.md is baked into the image
  and marked is bundled from ui. GET /offer -> 301. Only /offer/ is edge-exposed.
- caddy: route /offer/ to the sidecar; drop the now-dead landing /offer/
  handlers and the vite emit-offer plugin.
- offer: fill §4.3 (the chip-payment wording) and drop the in-page back link.
- landing footer: a feedback link (the offer's Telegram contact) beside the
  offer link.
- docs (ARCHITECTURE, FUNCTIONAL +_ru, renderer README), CI /offer/ probe,
  unit + integration + node tests.

docs/ARCHITECTURE.md

@@ -909,6 +909,17 @@ finished journal on each GET. The only degraded platform is a legacy Telegram cl
 predating `downloadFile`, where the GCG falls back to the old clipboard copy and the
 image option is not offered.
 
+The same sidecar also serves the **public offer page** at `/offer/` — the one edge-exposed
+route on it (caddy routes `/offer/` here; its `/render` stays internal). It reuses the shared
+`ui/src/lib/offer.ts` renderer (again one renderer, no drift) over the owner-edited
+`ui/legal/offer_ru.md`, baked into the image, splicing in the **live price list** (§4.4): it
+fetches the two catalog tables as markdown from the backend's internal
+`/api/v1/internal/offer/pricing` at the `<#pricing_template#>` marker, then renders the page. The
+backend projects the tables from the active catalog through `payments.Money` (no float reaches the
+page) and caches them in memory — built at boot, reprojected on any catalog edit — so a served
+render issues no query in the steady state and the page always reflects the current catalog without
+a redeploy. A backend outage degrades `/offer/` to a 502 rather than a stale price list.
+
 The alphabet-on-the-wire transport does **not** touch this invariant: the live edge
 exchanges alphabet indices, but the persisted journal (and everything derived from it —
 replay, history, GCG) keeps the decoded concrete letters described above, so an archived
@@ -1349,9 +1360,10 @@ in-process (the distroless image has no `/etc/mime.types`). Hash-named `/assets/
 in-compose **caddy** is the contour's edge: it owns a single `/_gm` Basic-Auth and
 routes `/_gm/grafana/*` to **Grafana** (anonymous-admin, so the one shared login gates
 it with no per-user Grafana accounts) and the rest of `/_gm/*` to the backend-rendered
-**admin console**; `/app/`, `/telegram/`, `/vk/` and the Connect path go to the gateway; the
-catch-all — notably the landing at `/`, plus the static public offer at `/offer/`
-(rendered from `ui/legal/offer_ru.md` at build time) — goes to the landing container. The
+**admin console**; `/app/`, `/telegram/`, `/vk/` and the Connect path go to the gateway; `/offer/`
+(the public offer, rendered by the `renderer` sidecar with the live catalog price list spliced in)
+goes to the render sidecar; and the catch-all — notably the landing at `/` — goes to the landing
+container. The
 **Telegram validator** runs as a separate container with **no public ingress**,
 answering only internal gRPC (HMAC, no Telegram egress). The **Telegram bot** holds
 no inbound port either: it dials the gateway's **bot-link** (mTLS) and egresses to