feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

docs/FUNCTIONAL.md

@@ -322,33 +322,40 @@ Finished games are archived in a dictionary-independent form and exportable in
 **two formats behind one 📤 button** — the GCG file and a rendered **PNG image** of
 the final position; the export is offered **only once a game is finished**, and
 never for an honest-AI practice game (a live game's export would leak the move
-journal; an AI game is throwaway). The format chooser is always the app's **own
-modal** — deliberately not Telegram's native popup, whose callback runs without
-user activation and silently breaks the share/clipboard delivery it leads to.
+journal; an AI game is throwaway). The format chooser is Telegram's **native popup**
+on Telegram Android/desktop (safe there: that chain is all bridge calls, which need
+no user activation) and the app's own modal elsewhere — on Telegram iOS the delivery
+is the OS share sheet, which a native-popup callback cannot open, and VK has no
+native chooser.
 
-The **image** is rendered on the client (Canvas 2D, always the light theme): the
-final board with classic coordinate axes A..O / 1..15 on the left — premium squares
-as plain colour fills, no text labels — and a compact per-seat scoresheet on the
-right: each seat's name and final score in the header (🏆 by the winner), then one
-row per move carrying the main word's classic coordinate (an across play is
-row-first, `8G`; a down play column-first, `H8` — the GCG convention), the word and
-its points; extra words of a multi-word play ride a smaller second line, non-play
-moves show as localized notes (pass/exchange/resign/timeout), and a closing ± row
-shows the endgame rack settlement when there was one (the final scores are
-authoritative — running totals alone do not include it). The footer stamps the site
-host and the finish date in the device locale. The scoresheet typography is fixed;
-a long game stretches the board (never below its minimum) so the image carries no
-dead space.
+The **image** is rendered on the server (the internal render sidecar runs the same
+drawing module the web client tests; always the light theme): the final board with
+classic coordinate axes A..O / 1..15 on the left — premium squares as plain colour
+fills, no text labels — and a compact per-seat scoresheet on the right: each seat's
+name and final score in the header (🏆 by the winner), then one row per move
+carrying the main word's classic coordinate (an across play is row-first, `8G`; a
+down play column-first, `H8` — the GCG convention), the word and its points; extra
+words of a multi-word play ride a smaller second line, non-play moves show as
+localized notes (pass/exchange/resign/timeout), and a closing ± row shows the
+endgame rack settlement when there was one (the final scores are authoritative —
+running totals alone do not include it). The footer stamps the site host and the
+finish date in the device locale. The scoresheet typography is fixed; a long game
+stretches the board (never below its minimum) so the image carries no dead space.
 
-Delivery per format: the **GCG** file is Web-Shared where the platform supports it;
-on an Android in-app client (Telegram / VK), which has neither Web Share nor a
-working file download, it copies the GCG text to the clipboard (with a confirming
-toast); otherwise it downloads the file. The **PNG** is Web-Shared or downloaded the
-same way, but a binary image has no clipboard-text fallback at all — so the image
-option is currently **withheld inside the in-app webviews** (Telegram / VK) and
-offered on the plain web and mobile browsers only; it returns there with the
-server-rendered signed-URL delivery (Telegram `downloadFile` /
-`VKWebAppDownloadFile`). Statistics (durable accounts only):
+Delivery is **one signed, short-lived link for both formats on every platform**,
+handed to the best affordance each platform has (each branch verified on-device):
+Telegram Android/desktop use Telegram's download dialog (whose own preview shares
+onwards); **Telegram iOS opens the OS share sheet** with the fetched file; VK iOS
+takes both formats through VK's download into its native share flow, while on the
+**VK Android client** — whose downloader hangs — the image opens in VK's native
+photo viewer (saving from its controls) and the GCG copies to the clipboard (the
+desktop VK iframe, an ordinary browser, downloads both); a **mobile browser gets
+the OS share sheet** (nothing lands in Downloads first); a desktop browser
+downloads the file. The link needs no login to fetch (the platforms' downloaders
+carry none) and is valid for minutes. The single exception is a legacy Telegram
+client without the download dialog (pre-Bot API 8.0): there the GCG falls back to
+the old clipboard copy (with the confirming toast) and the image option is not
+offered. Statistics (durable accounts only):
 wins, losses, draws, max points in a game, and max points for a single move (the
 best play, which already includes every word it formed plus the all-tiles bonus). It
 also shows the player's **move count** (their plays — passes and exchanges do not