build(ui): drop sourcemaps from prod bundle

The production UI build shipped `.map` files with full `sourcesContent`, and
the gateway/landing images serve `dist/` verbatim, so anyone could fetch
`/app/assets/main-*.js.map` (same assets under `/vk/`, `/telegram/`) and
reconstruct the entire TypeScript/Svelte source at the edge.

Gate `build.sourcemap` off for `mode === 'production'` (the Docker image build).
Dev and the `mock` e2e build (`vite build --mode mock`) keep maps for debugging.
Document the posture in ARCHITECTURE.md §12.

ui/vite.config.ts

@@ -34,7 +34,13 @@ export default defineConfig(({ mode }) => ({
   },
   build: {
     target: 'es2022',
-    sourcemap: true,
+    // Emit sourcemaps everywhere except the production build. A shipped `.map`
+    // carries full `sourcesContent` — the entire TypeScript/Svelte source — and the
+    // gateway/landing images serve `dist/` verbatim, so production maps would expose
+    // the whole client source at the edge. Dev and the `mock` e2e build
+    // (`vite build --mode mock`) keep maps for debugging; the production `vite build`
+    // (the Docker image build) drops them.
+    sourcemap: mode !== 'production',
     // Two entries: the game SPA (index.html, served at /app/ + /telegram/) and the
     // public landing page (landing.html, served at /). Assets are shared in dist/assets/, and
     // the relative base lets one build serve under any path.