feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

backend/internal/game/service.go

@@ -1363,30 +1363,53 @@ func (svc *Service) SetupDraws(ctx context.Context, gameID uuid.UUID) ([]SetupDr
 	return svc.store.SetupDraws(ctx, gameID)
 }
 
-// ExportGCG renders a game as GCG text from the journal alone (no dictionary). It
-// is allowed only on a finished game: exporting an in-progress game would leak the
-// full move journal mid-play, so an active game yields ErrGameActive.
-func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
+// ExportView returns a finished game with its journal and per-seat display names —
+// the material every export artifact (the GCG text, the PNG render payload) is built
+// from. It is allowed only on a finished game: exporting an in-progress game would
+// leak the full move journal mid-play, so an active game yields ErrGameActive. In an
+// honest-AI game the robot seat is labelled "AI", not its pool name.
+func (svc *Service) ExportView(ctx context.Context, gameID uuid.UUID) (Game, []HistoryMove, []string, error) {
 	g, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
-		return "", err
+		return Game{}, nil, nil, err
 	}
 	if g.Status != StatusFinished {
-		return "", ErrGameActive
+		return Game{}, nil, nil, ErrGameActive
 	}
 	moves, err := svc.store.GetJournal(ctx, gameID)
 	if err != nil {
-		return "", err
+		return Game{}, nil, nil, err
 	}
 	names := svc.seatNames(ctx, g)
 	if g.VsAI {
-		// Label the robot seat "AI" in an honest-AI game's export, not its pool name.
 		for _, s := range g.Seats {
 			if robot, err := svc.accounts.IsRobot(ctx, s.AccountID); err == nil && robot {
 				names[s.Seat] = aiPlayerName
 			}
 		}
 	}
+	return g, moves, names, nil
+}
+
+// EnsureExportable reports whether a game may be exported (it exists and is
+// finished) without loading the journal — the export-URL mint check.
+func (svc *Service) EnsureExportable(ctx context.Context, gameID uuid.UUID) error {
+	g, err := svc.store.GetGame(ctx, gameID)
+	if err != nil {
+		return err
+	}
+	if g.Status != StatusFinished {
+		return ErrGameActive
+	}
+	return nil
+}
+
+// ExportGCG renders a game as GCG text from the journal alone (no dictionary).
+func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
+	g, moves, names, err := svc.ExportView(ctx, gameID)
+	if err != nil {
+		return "", err
+	}
 	return writeGCG(g, names, moves), nil
 }