Stage 17 round 6 (#16-20): landing page, /app/ move, cache + stream fixes

Close out Stage 17 round 6:

- Landing page at / — one Vite build with two entries (index.html = game
  SPA, landing.html = a lightweight landing reusing the theme/i18n/
  aboutContent leaf modules, not the app store).
- Move the web game SPA to /app/; the Telegram Mini App stays at /telegram/
  (gateway webui.Handler(stripPrefix, indexName): landing at /, SPA at /app/
  + /telegram/). Per-language "Play in Telegram" link via new
  VITE_TELEGRAM_LINK_EN/_RU build vars (button hides when unset).
- Cache headers: hash-named /assets/* immutable, HTML shells no-cache (the
  go:embed zero modtime emitted no validators, so the client re-downloaded
  the whole bundle every launch).
- Live-stream 15s abort fix: an immediate heartbeat on open + a 10s default
  interval (the first tick at 15s raced the edge idle timeout -> reconnect
  storm).

PLAN/ARCHITECTURE(§13)/FUNCTIONAL(+ru)/gateway+ui+deploy READMEs updated;
round 6 closed. Tests: gateway webui/connectsrv units, ui landing unit + e2e,
full e2e (60) green.

docs/ARCHITECTURE.md

@@ -573,13 +573,16 @@ a dedicated redeem sub-limit or a longer code is the hardening step if abuse app
 ## 13. Deployment (informational)
 
 Single public origin, path-routed. The gateway **embeds** the static UI build
-(`go:embed`, baked in by a node stage in `gateway/Dockerfile`) and serves the one
-SPA at both `/` (web) and `/telegram/` (the Telegram Mini App; outside Telegram that
-path redirects to the root — the client-side guard). An in-compose **caddy** is the
+(`go:embed`, baked in by a node stage in `gateway/Dockerfile`). The Vite build has two
+entries: a lightweight **landing page** served at `/`, and the game **SPA** served at
+`/app/` (web) and `/telegram/` (the Telegram Mini App; outside Telegram that path
+redirects to the root — the client-side guard). Hash-named `/assets/*` are served
+`immutable` (a relaunch is a cache hit, not a re-download); the HTML shells are
+`no-cache` so a new deploy is picked up. An in-compose **caddy** is the
 contour's edge: it owns a single `/_gm` Basic-Auth and routes `/_gm/grafana/*` to
 **Grafana** (anonymous-admin, so the one shared login gates it with no per-user
 Grafana accounts) and the rest of `/_gm/*` to the backend-rendered **admin console**;
-everything else (`/`, `/telegram/`, the Connect edge) goes to the gateway. The
+everything else (`/`, `/app/`, `/telegram/`, the Connect edge) goes to the gateway. The
 **Telegram connector** runs as a separate container with **no public ingress** — it
 long-polls Telegram and egresses through a VPN sidecar, answering only internal gRPC.