Stage 8: UI social/account/history surfaces

Wire the deferred Stage 7 surfaces end-to-end (UI -> gateway transcode ->
backend REST -> existing domain services): friends (incl. one-time friend
codes), per-user blocks, friend-game invitations, profile editing + email
binding, the statistics screen, and the in-game history + GCG export.

Friends gain two add paths (interview decision, a deliberate plan change):
one-time 6-digit codes (friend_codes table, 12h TTL, single-use, rate-limited
redeem); and play-gated requests (shared game required) where an explicit
decline is permanent, an ignored request lapses after 30 days, and a code
bypasses a decline. Migration 00006 widens friendships_status_chk and adds
friend_codes.

Lobby notification badge is poll + push: a new generic `notify` event drives
it live; the client polls on open/focus. Language stays a single Settings
control that writes through to the durable account's preferred_language. GCG
export is finished-only (game.ErrGameActive) and shares/downloads the .gcg file.

Tests: backend unit + inttest (friend gate/decline/code, ListInvitations,
GetStats, GCG gate), gateway transcode round-trips + notify constructor, UI
vitest (codecs, win-rate, share choice) + Playwright social specs. Docs: PLAN
(Stage 8 done + refinements + TODO-5), ARCHITECTURE, FUNCTIONAL(+ru), UI_DESIGN,
TESTING, module READMEs.

backend/README.md

@@ -60,9 +60,14 @@ Stage 6 opens the backend to the edge. The route groups gain their first
 handlers (`internal/server/handlers_*.go`): gateway-only session endpoints under
 `/api/v1/internal` (Telegram/guest/email login → mint, resolve, revoke) and a
 slice of authenticated `/api/v1/user` operations (profile, submit play, game
-state, lobby enqueue/poll, chat). A new `internal/notify` hub feeds a second
-listener — `internal/pushgrpc`, a gRPC server (`BACKEND_GRPC_ADDR`) streaming
-live events (your-turn, opponent-moved, chat, nudge, match-found) to the gateway.
+state, lobby enqueue/poll, chat). Stage 8 fills in the social/account/history
+operations under `/api/v1/user`: `friends/*` (request/respond/cancel/unfriend,
+list/incoming, the one-time `code` issue/redeem), `blocks/*`, `invitations/*`
+(create/accept/decline/cancel/list), `PUT profile`, `email/{request,confirm}`,
+`stats`, and `games/:id/gcg` (finished-only). A new `internal/notify` hub feeds a
+second listener — `internal/pushgrpc`, a gRPC server (`BACKEND_GRPC_ADDR`) streaming
+live events (your-turn, opponent-moved, chat, nudge, match-found, notify) to the
+gateway.
 Migration `00005` adds `accounts.is_guest`: an ephemeral guest is a durable row
 with no identity, excluded from statistics. The shared wire contracts live in the
 sibling [`../pkg`](../pkg) module.