Stage 17 (contour round 2): Grafana Live/reload, rate-limit, iOS reconnect, hint/plaque/make-move UX

- Grafana: disable Live (GF_LIVE_MAX_CONNECTIONS=0) so its WebSocket no longer trips caddy Basic-Auth and re-prompts; admin console gains a Grafana nav link
- deploy: force-recreate config-only services so reseeded Grafana dashboards / Caddyfile are actually picked up (the move-duration panel was invisible because the bind-mount went stale)
- rate-limit: raise per-user budget 120/40 -> 300/80; UI skips reloading on the echo of the player's own move (fewer requests, no double-load)
- iOS/Telegram reconnect: suppress the connection banner while backgrounded and for a short grace after resume; reconnect silently; wire visibilitychange + pageshow/pagehide + Telegram activated/deactivated (Bot API 8.0)
- hint button disabled when 0 hints remain; nudge button shows a disabled state on your own turn
- players plaque: invert so the active seat pops (accent chip, raised) and others recede
- make-move UX: a direct ✅ commit button (no hold/popover); the Shuffle tab becomes ↩️ Reset while tiles are pending

gateway/internal/config/config.go

@@ -88,7 +88,11 @@ var (
 func DefaultRateLimit() RateLimitConfig {
 	return RateLimitConfig{
 		PublicPerMinute: 30, PublicBurst: 10,
-		UserPerMinute: 120, UserBurst: 40,
+		// Per-user (not per-IP): one user may run several devices, each holding a
+		// Subscribe stream and reloading state on every live event, so the authenticated
+		// budget is generous (a per-user cap cannot DoS the service). Raised in Stage 17
+		// after multi-device play tripped the old 120/40.
+		UserPerMinute: 300, UserBurst: 80,
 		AdminPerMinute: 60, AdminBurst: 20,
 		EmailPer10Min: 5, EmailBurst: 2,
 	}