feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

renderer/test/render.test.mjs

@@ -0,0 +1,37 @@
+// Smoke test for the render core: feeds the committed fixture (a real 35-move self-played
+// Russian Scrabble game) through renderRequest and asserts a sane PNG comes back. Pixel
+// goldens are deliberately avoided — font rasterization differs across hosts; the shared
+// drawing logic itself is unit-tested in ui/ (gameimage.test.ts).
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { renderRequest } from '../src/render.mjs';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const fixture = () => JSON.parse(readFileSync(join(here, '../testdata/request.json'), 'utf8'));
+
+function pngSize(buf) {
+  // IHDR is the first chunk: width/height are big-endian u32 at offsets 16/20.
+  return { w: buf.readUInt32BE(16), h: buf.readUInt32BE(20) };
+}
+
+test('renders the fixture game to a plausible PNG', async () => {
+  const png = await renderRequest(fixture());
+  assert.ok(png.length > 50_000, `png too small: ${png.length}`);
+  assert.deepEqual([...png.subarray(0, 8)], [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+  const { w, h } = pngSize(png);
+  // scale 2 over a MIN_SIDE 620 board + two seat columns: sanity bounds, not a golden.
+  assert.ok(w > 1600 && w < 3000, `unexpected width ${w}`);
+  assert.ok(h > 1000 && h < 3000, `unexpected height ${h}`);
+});
+
+test('rejects a payload without a game', async () => {
+  await assert.rejects(() => renderRequest({ moves: [] }), /bad payload/);
+});
+
+test('renders concurrently without cross-talk', async () => {
+  const [a, b] = await Promise.all([renderRequest(fixture()), renderRequest(fixture())]);
+  assert.equal(a.length, b.length);
+});