feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

gateway/internal/backendclient/client.go

@@ -39,10 +39,18 @@ const backendMaxIdleConns = 512
 type Client struct {
 	baseURL string
 	http    *http.Client
-	conn    *grpc.ClientConn
-	push    pushv1.PushClient
+	// dl serves the export downloads: the backend may wait on the render sidecar
+	// for several seconds, so these calls get their own, longer deadline than the
+	// ordinary REST budget.
+	dl   *http.Client
+	conn *grpc.ClientConn
+	push pushv1.PushClient
 }
 
+// exportDownloadTimeout bounds one export-download fetch end to end (the backend's
+// own sidecar budget is 15s).
+const exportDownloadTimeout = 30 * time.Second
+
 // New dials the backend push gRPC endpoint and prepares the REST client. The
 // backend lives on a trusted network segment, so the gRPC connection uses
 // insecure (plaintext) transport credentials (ARCHITECTURE.md §12).
@@ -62,11 +70,39 @@ func New(httpURL, grpcAddr string, timeout time.Duration) (*Client, error) {
 	return &Client{
 		baseURL: strings.TrimRight(httpURL, "/"),
 		http:    &http.Client{Timeout: timeout, Transport: transport},
+		dl:      &http.Client{Timeout: exportDownloadTimeout, Transport: transport},
 		conn:    conn,
 		push:    pushv1.NewPushClient(conn),
 	}, nil
 }
 
+// ExportDownload fetches a signed finished-game export artifact from the backend's
+// public group, forwarding the caller's public Host for the image footer. It returns
+// the bytes with the backend's Content-Type and Content-Disposition. rest is the
+// public path suffix after /dl (e.g. "/<game>/<kind>?e=…&s=…").
+func (c *Client) ExportDownload(ctx context.Context, rest, publicHost string) ([]byte, string, string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+"/api/v1/public/dl"+rest, nil)
+	if err != nil {
+		return nil, "", "", fmt.Errorf("backendclient: new request: %w", err)
+	}
+	if publicHost != "" {
+		req.Header.Set("X-Public-Host", publicHost)
+	}
+	resp, err := c.dl.Do(req)
+	if err != nil {
+		return nil, "", "", fmt.Errorf("backendclient: GET export: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, "", "", fmt.Errorf("backendclient: read export: %w", err)
+	}
+	if resp.StatusCode >= http.StatusMultipleChoices {
+		return nil, "", "", parseAPIError(resp.StatusCode, data)
+	}
+	return data, resp.Header.Get("Content-Type"), resp.Header.Get("Content-Disposition"), nil
+}
+
 // Close releases the gRPC connection.
 func (c *Client) Close() error { return c.conn.Close() }