feat(android): resolve gateway origin on native, skip SW, hide MVP purchases

Make the web SPA behave correctly inside the Capacitor native shell, where the
bundle loads from a local origin:

- New lib/origin.ts gatewayOrigin(): absolute URLs resolve to VITE_GATEWAY_URL on
  native (the finished-game export/share URL in Game.svelte and the Wallet
  site-root link), falling back to the page origin on web. transport.ts already
  resolved via VITE_GATEWAY_URL and is left as-is.
- Skip the PWA service worker on the native channel (the assets are already local;
  a worker would risk serving stale content across store updates).
- Hide the money-purchase UI in the MVP: new distribution.purchasesHidden() folds
  VITE_PAYMENTS_DISABLED and the Google Play flag. The Wallet "buy" tab shows a
  neutral, pointer-free note (wallet.purchasesSoon) for the RuStore MVP and keeps
  the RuStore stub Google-Play-only. A ?nopay mock force mirrors ?gp for the e2e.
- Native env types in vite-env.d.ts.

Client-only, contour-safe: no wire/proto/schema change; web/VK/Telegram unchanged.
Tests: origin + purchasesHidden unit tests, a ?nopay wallet e2e. svelte-check
clean, vitest green, web + native vite build clean.

.claude/CLAUDE.md

@@ -114,6 +114,10 @@ The native Android app (`ANDROID_PLAN.md`) is a Capacitor 8 wrapper of the `ui`
   eyeball per-variant tiles.
 - **Durable Playwright MCP servers** (chromium + webkit) exist for UI inspection (there's a
   plugin-config gotcha in wiring them).
+- **The `playwright test` runner can't fetch browsers in this sandbox** — `playwright install` dies
+  with `EBADF` against the Playwright CDN (blocked network), even with the sandbox off. Run the e2e in
+  **CI** (the `ui` job installs chromium+webkit), or drive a state live through the **Playwright MCP**
+  browser against a local `vite --mode mock` server for visual verification.
 - **`docker run -p ...` boot tests fail from the shell** (published ports unreachable in this env).
   Use **testcontainers** for container-backed tests.
 - **Distroless images run as UID 65532 (nonroot).** Bind-mounted TLS keys must be **0644** (not 0600)