Stage 8: UI social/account/history surfaces

Wire the deferred Stage 7 surfaces end-to-end (UI -> gateway transcode ->
backend REST -> existing domain services): friends (incl. one-time friend
codes), per-user blocks, friend-game invitations, profile editing + email
binding, the statistics screen, and the in-game history + GCG export.

Friends gain two add paths (interview decision, a deliberate plan change):
one-time 6-digit codes (friend_codes table, 12h TTL, single-use, rate-limited
redeem); and play-gated requests (shared game required) where an explicit
decline is permanent, an ignored request lapses after 30 days, and a code
bypasses a decline. Migration 00006 widens friendships_status_chk and adds
friend_codes.

Lobby notification badge is poll + push: a new generic `notify` event drives
it live; the client polls on open/focus. Language stays a single Settings
control that writes through to the durable account's preferred_language. GCG
export is finished-only (game.ErrGameActive) and shares/downloads the .gcg file.

Tests: backend unit + inttest (friend gate/decline/code, ListInvitations,
GetStats, GCG gate), gateway transcode round-trips + notify constructor, UI
vitest (codecs, win-rate, share choice) + Playwright social specs. Docs: PLAN
(Stage 8 done + refinements + TODO-5), ARCHITECTURE, FUNCTIONAL(+ru), UI_DESIGN,
TESTING, module READMEs.

backend/internal/server/dto_test.go

@@ -96,6 +96,24 @@ func TestGameDTOFromGame(t *testing.T) {
 	}
 }
 
+func TestProfileResponseForAwayWindow(t *testing.T) {
+	acc := account.Account{
+		ID:                uuid.New(),
+		DisplayName:       "Kaya",
+		PreferredLanguage: "ru",
+		TimeZone:          "Europe/Moscow",
+		AwayStart:         time.Date(0, 1, 1, 0, 0, 0, 0, time.UTC),
+		AwayEnd:           time.Date(0, 1, 1, 7, 30, 0, 0, time.UTC),
+	}
+	dto := profileResponseFor(acc)
+	if dto.AwayStart != "00:00" || dto.AwayEnd != "07:30" {
+		t.Fatalf("away window = (%q, %q), want (00:00, 07:30)", dto.AwayStart, dto.AwayEnd)
+	}
+	if dto.PreferredLanguage != "ru" || dto.TimeZone != "Europe/Moscow" {
+		t.Fatalf("profile dto mismatch: %+v", dto)
+	}
+}
+
 func TestMoveRecordDTOFrom(t *testing.T) {
 	rec := engine.MoveRecord{
 		Player:  1,