feat(game): official first-move tile draw + admin step-by-step replay

Decide who moves first by the official rule: each seated player draws one
tile, the one closest to "A" leads (a blank beats every letter), ties
re-drawing until a single leader remains. Each draw uses honest per-draw
crypto/rand entropy (not the deterministic bag seed), so the recorded draw —
not a seed — is the only account of the outcome. The leader takes seat 0, so
the engine and journal replay are unchanged.

The draw is recorded with the game (game_setup_draws, migration 00013) for
future tournaments, designed as a discrete "player N draws a tile" step.
Friend/AI games draw at creation. Auto-match draws when the game opens,
against a synthetic uuid.Nil opponent whose draw rows (NULL account_id) are
back-filled to the real opponent on join — so the opener's seat is fixed up
front and the existing open-game pre-move is preserved with no reseating.

Admin /_gm/games/:id gains the recorded draw list and a simple step-by-step
board replay (game.ReplayTimeline + a vanilla-JS stepper): a board with
A-O/1-15 headers and highlighted premium squares, placed letters with their
tile value as a subscript, rack panels around the board (seat 0 top, 1
bottom, 2 left, 3 right) with the current player highlighted, and a per-move
log with the tiles drawn and the bag remainder.

Docs: ARCHITECTURE §6/§9, FUNCTIONAL (+_ru), PRERELEASE (FM row), design spec.

docs/FUNCTIONAL.md

@@ -271,8 +271,9 @@ at its end (the game could not be continued), and the same note rides the GCG ex
 Operators reach a server-rendered admin console at `${DOMAIN}/_gm` — the backend
 renders it; the gateway gates it with HTTP Basic Auth on its public listener and
 proxies it verbatim. The console lists and inspects **users** (profile, statistics,
-identities, their games) and **games** (summary + seats), works the **word-complaint
-review queue** — resolving each as reject / accept-add / accept-remove — and exposes
+identities, their games) and **games** — summary, seats, the recorded **first-move tile
+draw** (who drew what, deciding who leads), and a simple **step-by-step board replay** of the
+whole game — works the **word-complaint review queue** — resolving each as reject / accept-add / accept-remove — and exposes
 the **dictionary**: the active version new games pin, the resident versions per
 variant, an online **dictionary update** (upload the `scrabble-dawg-vX.Y.Z.tar.gz`
 release archive, preview the words added and removed per variant against the active