feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

ui/src/lib/codec.test.ts

@@ -6,6 +6,7 @@ import {
   decodeBlockStatus,
   decodeDraftView,
   decodeEvent,
+  decodeExportUrl,
   decodeFriendList,
   decodeGameList,
   decodeInvitation,
@@ -24,6 +25,7 @@ import {
   encodeDraftSave,
   encodeEnqueue,
   encodeExchange,
+  encodeExportUrlRequest,
   encodeGuestLogin,
   encodeStateRequest,
   encodeSubmitPlay,
@@ -34,6 +36,30 @@ import {
 } from './codec';
 
 describe('codec', () => {
+  it('round-trips the export-url request and response', () => {
+    const req = fb.ExportUrlRequest.getRootAsExportUrlRequest(
+      new ByteBuffer(
+        encodeExportUrlRequest('g-1', 'png', 'ru-RU', ['пас', 'обмен', 'сдался', 'таймаут'], 'Europe/Moscow'),
+      ),
+    );
+    expect(req.gameId()).toBe('g-1');
+    expect(req.kind()).toBe('png');
+    expect(req.dateLocale()).toBe('ru-RU');
+    expect(req.timeZone()).toBe('Europe/Moscow');
+    expect(req.actionLabelsLength()).toBe(4);
+    expect(req.actionLabels(1)).toBe('обмен');
+
+    const b = new Builder(128);
+    const path = b.createString('/dl/g-1/png?e=1&s=x');
+    const fn = b.createString('game-g-1.png');
+    fb.ExportUrl.startExportUrl(b);
+    fb.ExportUrl.addPath(b, path);
+    fb.ExportUrl.addFilename(b, fn);
+    b.finish(fb.ExportUrl.endExportUrl(b));
+    const out = decodeExportUrl(b.asUint8Array());
+    expect(out).toEqual({ path: '/dl/g-1/png?e=1&s=x', filename: 'game-g-1.png' });
+  });
+
   it('encodes an enqueue request carrying the variant, word rule and vs_ai flag', () => {
     for (const vsAi of [false, true]) {
       const req = fb.EnqueueRequest.getRootAsEnqueueRequest(