Stage 4: lobby & social (matchmaking, friends, blocks, chat+nudge, invitations, profile, email, multi-player drop-out)

Engine: multi-player drop-out-and-continue with a per-game tile disposition (remove default / return), resigned seats skipped and excluded from the win, leaver rack never revealed; 2-player behaviour unchanged.

New domains (service/store, no HTTP yet): internal/social (friend request/accept graph, per-user blocks, per-game chat with nudge as a message kind, content filter via mvdan.cc/xurls/v2 + leet/separator normaliser + phone heuristic) and internal/lobby (in-memory variant-keyed matchmaking pool, friend-game invitations invite->accept with lazy 7-day expiry). account gains profile editing and the email confirm-code flow (Mailer seam: SMTP or log mailer).

Migration 00003_social.sql + regenerated jet. main wires the new services into the server (accessors for the Stage 6 handlers); robot substitution stays in Stage 5, REST/stream/push in Stage 6/8. Docs (PLAN, ARCHITECTURE, FUNCTIONAL+ru, TESTING, README) updated.

backend/internal/account/email_test.go

@@ -0,0 +1,67 @@
+package account
+
+import (
+	"errors"
+	"regexp"
+	"testing"
+)
+
+func TestNormalizeEmail(t *testing.T) {
+	tests := []struct {
+		name    string
+		in      string
+		want    string
+		wantErr bool
+	}{
+		{"lowercases", "User@Example.COM", "user@example.com", false},
+		{"trims", "  a@b.io  ", "a@b.io", false},
+		{"strips display name", "Jane Doe <jane@x.org>", "jane@x.org", false},
+		{"empty", "", "", true},
+		{"no at sign", "notanemail", "", true},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := normalizeEmail(tc.in)
+			if tc.wantErr {
+				if !errors.Is(err, ErrInvalidEmail) {
+					t.Fatalf("err = %v, want ErrInvalidEmail", err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tc.want {
+				t.Errorf("got %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestGenerateCodeFormat(t *testing.T) {
+	sixDigits := regexp.MustCompile(`^\d{6}$`)
+	for range 50 {
+		code, hash, err := generateCode()
+		if err != nil {
+			t.Fatalf("generate: %v", err)
+		}
+		if !sixDigits.MatchString(code) {
+			t.Fatalf("code %q is not exactly six digits", code)
+		}
+		if hash != hashCode(code) {
+			t.Errorf("returned hash does not match hashCode(%q)", code)
+		}
+	}
+}
+
+func TestHashCodeStable(t *testing.T) {
+	if hashCode("123456") != hashCode("123456") {
+		t.Fatal("hashCode is not deterministic")
+	}
+	if hashCode("123456") == hashCode("654321") {
+		t.Fatal("distinct codes must not share a hash")
+	}
+	if got := len(hashCode("000000")); got != 64 {
+		t.Errorf("hex SHA-256 length = %d, want 64", got)
+	}
+}