feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

ui/src/lib/codec.ts

@@ -22,6 +22,7 @@ import type {
   EvalResult,
   FeedbackState,
   FriendCode,
+  ExportUrl,
   GameList,
   GameView,
   GcgExport,
@@ -882,6 +883,36 @@ export function decodeGcg(buf: Uint8Array): GcgExport {
   return { gameId: s(g.gameId()), filename: s(g.filename()), content: s(g.content()) };
 }
 
+export function encodeExportUrlRequest(
+  gameId: string,
+  kind: 'png' | 'gcg',
+  dateLocale: string,
+  actionLabels: string[],
+  timeZone: string,
+): Uint8Array {
+  const b = new Builder(256);
+  const gid = b.createString(gameId);
+  const k = b.createString(kind);
+  const dl = b.createString(dateLocale);
+  const tz = b.createString(timeZone);
+  const labels = fb.ExportUrlRequest.createActionLabelsVector(
+    b,
+    actionLabels.map((l) => b.createString(l)),
+  );
+  fb.ExportUrlRequest.startExportUrlRequest(b);
+  fb.ExportUrlRequest.addGameId(b, gid);
+  fb.ExportUrlRequest.addKind(b, k);
+  fb.ExportUrlRequest.addDateLocale(b, dl);
+  fb.ExportUrlRequest.addActionLabels(b, labels);
+  fb.ExportUrlRequest.addTimeZone(b, tz);
+  return finish(b, fb.ExportUrlRequest.endExportUrlRequest(b));
+}
+
+export function decodeExportUrl(buf: Uint8Array): ExportUrl {
+  const e = fb.ExportUrl.getRootAsExportUrl(new ByteBuffer(buf));
+  return { path: s(e.path()), filename: s(e.filename()) };
+}
+
 function emptyGame(): GameView {
   return {
     id: '',