feat(export): server-rendered artifacts behind one signed download URL (#160)

The finished-game export (GCG + a new PNG of the final position) is one
signed, short-lived relative URL (game.export_url; HMAC-SHA256, 10-min
TTL, BACKEND_EXPORT_SIGN_KEY) resolved against the client's own origin
and delivered by the best affordance each platform has (five on-device
review rounds):

- TG Android/desktop: native showPopup chooser -> native downloadFile
  dialog (bridge-only chain, activation-safe).
- TG iOS: app-modal chooser -> OS share sheet with the fetched file
  (a popup callback cannot supply the activation the sheet needs).
- VK iOS: VKWebAppDownloadFile for both formats.
- VK Android: the PNG opens in VK's native image viewer, the GCG copies
  to the clipboard (the VK Android downloader hangs on any download,
  Content-Length/Range notwithstanding).
- VK desktop iframe / desktop browsers: plain anchor downloads.
- Mobile browsers: the OS share sheet (fetch-then-share).
- Legacy TG (< Bot API 8.0): app modal + GCG clipboard, no image option.

The PNG is rasterized on demand by the new internal `renderer` sidecar
(node:22-slim + skia-canvas + baked Liberation/Noto Color Emoji fonts)
executing the SAME ui/src/lib/gameimage.ts the ui project unit-tests;
the backend rebuilds the render payload from the journal +
engine.AlphabetTable, and the device date locale, IANA time zone and
localized non-play labels ride the signed URL. Nothing is stored — the
artifact re-derives from the immutable journal on each GET. The gateway
forwards /dl/* (caddy @gateway matcher extended) behind the per-IP
public rate limiter and serves bytes via http.ServeContent.

Deploy: renderer service in compose + prod overlay + rolling order +
prod push list; TEST_/PROD_EXPORT_SIGN_KEY secrets; the sidecar smoke
runs in the ui CI job. Docs: ARCHITECTURE, FUNCTIONAL(+_ru), UI_DESIGN,
TESTING, deploy/README, renderer/README.

ui/src/lib/telegram.ts

@@ -67,6 +67,7 @@ interface TelegramWebApp {
   };
   showConfirm?: (message: string, cb?: (ok: boolean) => void) => void;
   showPopup?: (params: TelegramPopupParams, cb?: (buttonId: string) => void) => void;
+  downloadFile?: (params: { url: string; file_name: string }, cb?: (accepted: boolean) => void) => void;
 }
 
 function webApp(): TelegramWebApp | undefined {
@@ -372,7 +373,8 @@ export function telegramShowConfirm(message: string): Promise<boolean> {
 /**
  * telegramShowPopup shows Telegram's native popup and resolves the pressed button id (the empty
  * string when dismissed without pressing a button). Resolves null outside Telegram or on a client
- * predating the popup, so callers can fall back to their own modal.
+ * predating the popup, so callers can fall back to their own modal. NOTE: the callback runs with
+ * no user activation — never lead from it into navigator.share or a clipboard write.
  */
 export function telegramShowPopup(params: TelegramPopupParams): Promise<string | null> {
   const w = webApp();
@@ -380,6 +382,29 @@ export function telegramShowPopup(params: TelegramPopupParams): Promise<string |
   return new Promise((resolve) => w.showPopup!(params, (id) => resolve(id ?? '')));
 }
 
+/** telegramCanDownloadFile reports whether the native download dialog exists (Bot API 8.0). */
+export function telegramCanDownloadFile(): boolean {
+  return !!webApp()?.downloadFile;
+}
+
+/** telegramPlatform returns the SDK's platform tag ('ios', 'android', 'tdesktop', …) or ''
+ *  outside Telegram — the export delivery branches on it (iOS gets the OS share sheet). */
+export function telegramPlatform(): string {
+  return webApp()?.platform ?? '';
+}
+
+/**
+ * telegramDownloadFile asks Telegram to download url as fileName through its native
+ * dialog — the Mini App file delivery that works on every Telegram platform (a webview
+ * <a download> does not). Returns false outside Telegram or on a client predating it.
+ */
+export function telegramDownloadFile(url: string, fileName: string): boolean {
+  const w = webApp();
+  if (!w?.downloadFile) return false;
+  w.downloadFile({ url, file_name: fileName });
+  return true;
+}
+
 /** Haptic is the set of feedbacks the app triggers. */
 export type Haptic = 'select' | 'success' | 'error' | 'warning' | 'light' | 'medium' | 'heavy';