Stage 8: UI social/account/history surfaces

Wire the deferred Stage 7 surfaces end-to-end (UI -> gateway transcode ->
backend REST -> existing domain services): friends (incl. one-time friend
codes), per-user blocks, friend-game invitations, profile editing + email
binding, the statistics screen, and the in-game history + GCG export.

Friends gain two add paths (interview decision, a deliberate plan change):
one-time 6-digit codes (friend_codes table, 12h TTL, single-use, rate-limited
redeem); and play-gated requests (shared game required) where an explicit
decline is permanent, an ignored request lapses after 30 days, and a code
bypasses a decline. Migration 00006 widens friendships_status_chk and adds
friend_codes.

Lobby notification badge is poll + push: a new generic `notify` event drives
it live; the client polls on open/focus. Language stays a single Settings
control that writes through to the durable account's preferred_language. GCG
export is finished-only (game.ErrGameActive) and shares/downloads the .gcg file.

Tests: backend unit + inttest (friend gate/decline/code, ListInvitations,
GetStats, GCG gate), gateway transcode round-trips + notify constructor, UI
vitest (codecs, win-rate, share choice) + Playwright social specs. Docs: PLAN
(Stage 8 done + refinements + TODO-5), ARCHITECTURE, FUNCTIONAL(+ru), UI_DESIGN,
TESTING, module READMEs.

backend/internal/game/service.go

@@ -566,6 +566,16 @@ func (svc *Service) Participants(ctx context.Context, gameID uuid.UUID) ([]uuid.
 	return seats, g.ToMove, g.Status, nil
 }
 
+// SharedGame reports whether accounts a and b are seated together in any game
+// (active or finished). It backs the social package's "befriend an opponent"
+// request gate without exposing the games tables; a self-pair is never shared.
+func (svc *Service) SharedGame(ctx context.Context, a, b uuid.UUID) (bool, error) {
+	if a == b {
+		return false, nil
+	}
+	return svc.store.SharedGameExists(ctx, a, b)
+}
+
 // ListForAccount returns every game the account is seated in, newest first, for the
 // lobby's active/finished lists. The live position is not loaded — the summaries come
 // straight from the durable rows.
@@ -586,12 +596,17 @@ func (svc *Service) History(ctx context.Context, gameID uuid.UUID) (HistoryView,
 	return HistoryView{Game: g, Moves: moves}, nil
 }
 
-// ExportGCG renders a game as GCG text from the journal alone (no dictionary).
+// ExportGCG renders a game as GCG text from the journal alone (no dictionary). It
+// is allowed only on a finished game: exporting an in-progress game would leak the
+// full move journal mid-play, so an active game yields ErrGameActive.
 func (svc *Service) ExportGCG(ctx context.Context, gameID uuid.UUID) (string, error) {
 	g, err := svc.store.GetGame(ctx, gameID)
 	if err != nil {
 		return "", err
 	}
+	if g.Status != StatusFinished {
+		return "", ErrGameActive
+	}
 	moves, err := svc.store.GetJournal(ctx, gameID)
 	if err != nil {
 		return "", err

backend/internal/game/store.go

@@ -135,6 +135,24 @@ func (s *Store) GetGame(ctx context.Context, id uuid.UUID) (Game, error) {
 	return projectGame(grow, srows)
 }
 
+// SharedGameExists reports whether accounts a and b are both seated in at least
+// one game (active or finished). It backs the social package's "befriend an
+// opponent" gate via a self-join on game_players.
+func (s *Store) SharedGameExists(ctx context.Context, a, b uuid.UUID) (bool, error) {
+	other := table.GamePlayers.AS("other")
+	stmt := postgres.SELECT(table.GamePlayers.GameID).
+		FROM(table.GamePlayers.INNER_JOIN(other, other.GameID.EQ(table.GamePlayers.GameID))).
+		WHERE(
+			table.GamePlayers.AccountID.EQ(postgres.UUID(a)).
+				AND(other.AccountID.EQ(postgres.UUID(b))),
+		).LIMIT(1)
+	var rows []model.GamePlayers
+	if err := stmt.QueryContext(ctx, s.db, &rows); err != nil {
+		return false, fmt.Errorf("game: shared game exists: %w", err)
+	}
+	return len(rows) > 0, nil
+}
+
 // ListGamesForAccount loads every game the account is seated in (active and
 // finished), newest first, each joined with its ordered seats. It backs the lobby's
 // "my games" lists.

backend/internal/game/types.go

@@ -29,6 +29,9 @@ var (
 	ErrNotYourTurn = errors.New("game: not the player's turn")
 	// ErrFinished is returned when a transition is attempted on a finished game.
 	ErrFinished = errors.New("game: game is finished")
+	// ErrGameActive is returned when an operation allowed only on a finished game
+	// (such as a GCG export) is attempted while the game is still active.
+	ErrGameActive = errors.New("game: game is still active")
 	// ErrNotAPlayer is returned when an account is not seated in the game.
 	ErrNotAPlayer = errors.New("game: account is not a player in this game")
 	// ErrInvalidConfig is returned when CreateParams are not acceptable.