feat(export): platform-native delivery — TG popup+downloadFile, VK viewer, mobile share sheet

Per the on-device review, the last hop is now the most native affordance
per platform, all fed by the same signed URL:

- Telegram: the native showPopup chooser returns (safe here — the whole
  TG chain is bridge calls, which need no user activation) and both
  formats go to the native downloadFile dialog on iOS and Android alike.
- VK: the PNG opens in VK's native photo viewer (VKWebAppShowImages) —
  on screen at once, saved/shared from the viewer's own controls; the
  GCG keeps VKWebAppDownloadFile; either falls back to a plain anchor
  download (the desktop iframe). The gateway now serves /dl/* via
  http.ServeContent (Content-Length + Range/206) — another swing at the
  VK Android DownloadManager hang; if it persists, the next step is the
  clipboard fallback for the VK-Android GCG.
- Mobile browsers: the OS share sheet with the fetched file (the proven
  fetch-then-share pattern) — nothing lands in Downloads first; desktop
  keeps the anchor download.

Legacy Telegram (< 8.0, no downloadFile) keeps the app modal + GCG
clipboard copy and hides the image option.

docs/UI_DESIGN.md

@@ -406,15 +406,19 @@ enabled on the first, uncached load) and flip in place when an event refreshes t
 - **History / export**: the in-game slide-down history lays each move out in a per-seat grid
   (the word(s) and the move score, no running total); the 📤 in the history header appears
   only once the game is finished — never in an honest-AI game (throwaway practice) — and
-  opens the **format chooser**: always the app's own modal, never Telegram's native popup
-  (a `showPopup` callback carries no user activation, which silently breaks gesture-gated
-  delivery APIs — on-device finding). The accent button leads with the image, the GCG file
-  is the quiet alternative; both need the connection. Both formats travel the same
-  signed-URL route: the app mints a relative link (`game.export_url`), resolves it against
-  its own origin and hands it to the platform's native download — Telegram `downloadFile`,
-  `VKWebAppDownloadFile`, else a plain anchor download (also the desktop VK iframe, where
-  the bridge method is absent and the anchor works). A legacy Telegram client without
-  `downloadFile` keeps the old GCG clipboard copy and hides the image option. Confirming a
+  opens the **format chooser**: Telegram's native popup inside Telegram — safe there,
+  since the whole TG chain is bridge calls needing no user activation (a popup callback
+  must never lead into `navigator.share`/clipboard, the on-device finding) — and the app's
+  own modal elsewhere (VK has no native chooser; the accent button leads with the image,
+  both options need the connection). Both formats mint the same signed relative link
+  (`game.export_url`), resolved against the app's own origin, then delivered natively:
+  Telegram `downloadFile` (both TG platforms); on VK the PNG opens in the native photo
+  viewer (`VKWebAppShowImages`, save/share from its controls) and the GCG goes through
+  `VKWebAppDownloadFile`, both falling back to a plain anchor download (the desktop
+  iframe); a mobile browser fetches the bytes and opens the OS share sheet
+  (`navigator.share` with the file — the proven fetch-then-share pattern), a desktop
+  browser downloads by anchor. A legacy Telegram client without `downloadFile` keeps the
+  old GCG clipboard copy, hides the image option and stays on the app modal. Confirming a
   resign reveals the full board: it closes the history drawer (portrait) and zooms the
   board out.
 - **Export image** (`lib/gameimage.ts` — the shared drawing module the render sidecar