feat(offer): live catalog price list in the public offer, served by the render sidecar

Robokassa moderation requires the public offer to list every digital good with
its price. Move /offer/ off the static landing container to the render sidecar:
it splices the live catalog price list (§4.4) into the owner-edited
ui/legal/offer_ru.md and renders it with the shared ui/src/lib/offer.ts — one
renderer, no drift, always matching the current catalog with no redeploy.

- backend: /api/v1/internal/offer/pricing (internal, off the edge allow-list)
  projects the active catalog into two markdown tables — chip packs priced per
  rail (roubles / VK votes / Telegram Stars) and chip-priced values — through
  payments.Money so no float reaches the page. Cached in memory: warmed at boot,
  marked stale on every catalog mutation, so a served render issues no query.
- renderer: GET /offer/ fetches the tables and substitutes them at the
  <#pricing_template#> marker, then renders; offer_ru.md is baked into the image
  and marked is bundled from ui. GET /offer -> 301. Only /offer/ is edge-exposed.
- caddy: route /offer/ to the sidecar; drop the now-dead landing /offer/
  handlers and the vite emit-offer plugin.
- offer: fill §4.3 (the chip-payment wording) and drop the in-page back link.
- landing footer: a feedback link (the offer's Telegram contact) beside the
  offer link.
- docs (ARCHITECTURE, FUNCTIONAL +_ru, renderer README), CI /offer/ probe,
  unit + integration + node tests.

renderer/README.md

@@ -1,10 +1,10 @@
-# renderer — the finished-game image-render sidecar
+# renderer — the render sidecar (finished-game image + public offer page)
 
-An internal-only Node service that rasterizes the finished-game export PNG. It runs the
-**same** `ui/src/lib/gameimage.ts` the web project unit-tests — bundled verbatim at image
-build time (`src/entry.ts` → esbuild → `dist/gameimage.mjs`) — on
-[skia-canvas](https://github.com/samizdatco/skia-canvas), so the server render is
-pixel-identical to the design the owner signed off in the browser.
+An internal Node service that runs shared `ui/src/lib` renderers server-side — bundled verbatim at
+image build time (`src/entry.ts` → esbuild → `dist/gameimage.mjs`) so there is one renderer and no
+drift from the browser. It serves two surfaces: the finished-game export **PNG** (on
+[skia-canvas](https://github.com/samizdatco/skia-canvas), pixel-identical to the design the owner
+signed off) and the public **offer page**.
 
 ## Interface
 
@@ -12,20 +12,30 @@ pixel-identical to the design the owner signed off in the browser.
   `image/png`. `game`/`moves` are the ui-model shapes (`GameView` / `MoveRecord[]`);
   `alphabet` is the per-variant `(index, letter, value)` table tile values are drawn
   from; `labels` localizes the non-play moves (pass/exchange/resign/timeout);
-  `hostname` + `dateLocale` feed the footer.
+  `hostname` + `dateLocale` feed the footer. Internal-only.
+- `GET /offer/` — the public offer page as `text/html`: the owner-edited `ui/legal/offer_ru.md`
+  (baked into the image, read at boot) with the live catalog **price list** (§4.4) fetched as
+  markdown from the backend's internal `/api/v1/internal/offer/pricing` (`RENDERER_BACKEND_URL`)
+  and spliced in at the `<#pricing_template#>` marker, then rendered by the shared
+  `ui/src/lib/offer.ts`. `GET /offer` → 301 `/offer/`. **The only edge-exposed route** — caddy
+  routes `/offer/` here; a backend outage yields a 502, never a stale price list.
 - `GET /healthz` — liveness (the compose healthcheck the backend's `depends_on` gates on).
 
-The service draws and nothing else: authentication, the participant check and the signed
-public download URL all live in the backend (`backend/internal/server/export.go`); the
-network path is client → gateway `/dl/*` → backend → this sidecar.
+The service renders and nothing else: for the PNG, authentication, the participant check and the
+signed public download URL all live in the backend (`backend/internal/server/export.go`), the path
+being client → gateway `/dl/*` → backend → this sidecar; for the offer, the catalog projection and
+its cache live in the backend (`backend/internal/payments/offer.go`) and no user input reaches the
+page.
 
 ## Development
 
 ```sh
 pnpm install          # skia-canvas + esbuild MUST stay approved in pnpm-workspace.yaml
                       # (allowBuilds) or the native binary is silently never fetched
-pnpm test             # bundles, then node --test against testdata/request.json
-node src/server.mjs   # local run on :8090 (RENDERER_PORT overrides)
+pnpm test             # bundles, then node --test (PNG smoke + offer splice)
+# local run on :8090 (RENDERER_PORT overrides). For /offer/, point at the offer source and a
+# reachable backend (else the boot read / the price fetch fail):
+RENDERER_OFFER_MD=../ui/legal/offer_ru.md RENDERER_BACKEND_URL=http://localhost:8080 node src/server.mjs
 ```
 
 The runtime image (`renderer/Dockerfile`, `node:22-slim`) bakes in Liberation Sans (the