feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

gateway/internal/transcode/transcode_social_test.go

@@ -263,6 +263,54 @@ func TestGcgRoundTrip(t *testing.T) {
 	}
 }
 
+func TestExportURLRoundTrip(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/user/games/g-1/export-url" {
+			t.Errorf("unexpected path %q", r.URL.Path)
+		}
+		q := r.URL.Query()
+		if q.Get("kind") != "png" || q.Get("dl") != "ru-RU" || q.Get("tz") != "Europe/Moscow" || q.Get("t") != "пас,обмен,сдался,таймаут" {
+			t.Errorf("unexpected query %q", r.URL.RawQuery)
+		}
+		_, _ = w.Write([]byte(`{"path":"/dl/g-1/png?e=1&s=x","filename":"game-g-1.png"}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, _ := reg.Lookup(transcode.MsgGameExportURL)
+
+	b := flatbuffers.NewBuilder(256)
+	gid := b.CreateString("g-1")
+	kind := b.CreateString("png")
+	dl := b.CreateString("ru-RU")
+	tz := b.CreateString("Europe/Moscow")
+	labels := make([]flatbuffers.UOffsetT, 0, 4)
+	for _, s := range []string{"пас", "обмен", "сдался", "таймаут"} {
+		labels = append(labels, b.CreateString(s))
+	}
+	fb.ExportUrlRequestStartActionLabelsVector(b, len(labels))
+	for i := len(labels) - 1; i >= 0; i-- {
+		b.PrependUOffsetT(labels[i])
+	}
+	vec := b.EndVector(len(labels))
+	fb.ExportUrlRequestStart(b)
+	fb.ExportUrlRequestAddGameId(b, gid)
+	fb.ExportUrlRequestAddKind(b, kind)
+	fb.ExportUrlRequestAddDateLocale(b, dl)
+	fb.ExportUrlRequestAddActionLabels(b, vec)
+	fb.ExportUrlRequestAddTimeZone(b, tz)
+	b.Finish(fb.ExportUrlRequestEnd(b))
+
+	payload, err := op.Handler(context.Background(), transcode.Request{UserID: "u-1", Payload: b.FinishedBytes()})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	res := fb.GetRootAsExportUrl(payload, 0)
+	if string(res.Path()) != "/dl/g-1/png?e=1&s=x" || string(res.Filename()) != "game-g-1.png" {
+		t.Fatalf("export url decoded wrong: path=%q filename=%q", res.Path(), res.Filename())
+	}
+}
+
 func TestProfileUpdateRoundTripAway(t *testing.T) {
 	var gotBody map[string]any
 	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {