feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

ui/src/lib/share.ts

@@ -81,42 +81,52 @@ function downloadFile(content: Blob | string, filename: string, type = 'applicat
 }
 
 /**
- * pickImageDelivery decides how to deliver the PNG game image: Web Share (with the file)
- * wherever it exists — mobile browsers and the iOS Telegram Mini App — else a Blob download.
- * The image option is not offered inside the in-app WebViews at all (Android Telegram/VK, the
- * desktop VK iframe): a binary PNG has no working route there until the server-rendered
- * signed-URL delivery lands, so this decision never sees them. Pure, unit-tested with a mock
- * navigator.
+ * downloadUrl saves a same-origin signed export URL as a file through a temporary
+ * anchor: the server names it via Content-Disposition, the download attribute is the
+ * same-origin hint. This is the browser leg of the unified export delivery; the in-app
+ * WebViews never reach it (they use the platform's native download call instead), so
+ * the iOS blob-URL navigation trap does not apply — this is a real https URL.
  */
-export function pickImageDelivery(nav: ShareNav | undefined, file: File): 'share' | 'download' {
-  if (
-    nav &&
-    typeof nav.canShare === 'function' &&
-    typeof nav.share === 'function' &&
-    nav.canShare({ files: [file] })
-  ) {
-    return 'share';
-  }
-  return 'download';
+export function downloadUrl(url: string, filename: string): void {
+  if (typeof document === 'undefined') return;
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = filename;
+  document.body.appendChild(a);
+  a.click();
+  a.remove();
 }
 
 /**
- * shareOrDownloadImage delivers the rendered game image and reports the route taken. The Web
- * Share invariant matches shareOrDownloadGcg: a cancelled or failed share is a deliberate
- * no-op, never a Blob-download fallback (an <a download> strands the iOS WKWebView on the
- * blob: URL).
+ * shareUrlAsFile delivers a signed export URL through the OS share sheet where files can
+ * be shared (mobile browsers): it fetches the same-origin bytes, wraps them in a File and
+ * calls navigator.share — the sheet opens directly, nothing lands in Downloads first. The
+ * fetch-then-share chain keeps the click's user activation (the proven GCG pattern).
+ * Where file sharing is absent (desktop) it falls back to the plain anchor download. A
+ * cancelled share is a no-op by the shareOrDownloadGcg invariant.
  */
-export async function shareOrDownloadImage(file: File): Promise<'shared' | 'downloaded'> {
+export async function shareUrlAsFile(url: string, filename: string, mime: string): Promise<'shared' | 'downloaded' | 'failed'> {
   const nav = typeof navigator !== 'undefined' ? navigator : undefined;
-  if (pickImageDelivery(nav, file) === 'share' && nav) {
+  if (nav && typeof nav.share === 'function' && typeof nav.canShare === 'function') {
     try {
-      await nav.share({ files: [file], title: file.name });
+      const resp = await fetch(url);
+      if (!resp.ok) return 'failed';
+      const file = new File([await resp.blob()], filename, { type: mime });
+      if (nav.canShare({ files: [file] })) {
+        try {
+          // No title: iOS pastes it as accompanying text next to the image; the named
+          // file speaks for itself.
+          await nav.share({ files: [file] });
+        } catch {
+          /* cancelled — intentionally a no-op */
+        }
+        return 'shared';
+      }
     } catch {
-      /* cancelled or failed — intentionally a no-op (see shareOrDownloadGcg) */
+      return 'failed';
     }
-    return 'shared';
   }
-  downloadFile(file, file.name, file.type);
+  downloadUrl(url, filename);
   return 'downloaded';
 }