Stage 17 #2: Connecting indicator + auto-retry, instead of red toasts

Connectivity failures become state, not a toast on every attempt. A global online
signal (lib/connection.svelte.ts) flips on a transport unavailable / rate_limited and
on the live stream's drop, driving a pure-CSS header spinner + 'Connecting…' in place
of the title and softly disabling the in-game server actions (commit / exchange / pass
/ hint; local board/rack/reset stay live).

- transport: exec auto-retries with capped exponential backoff — every op on a
  rate-limit (rejected before processing, safe), reads only on unavailable (a mutation
  is never blindly re-sent, to avoid double-applying one whose response was lost; its
  button is disabled while offline so the player re-issues on reconnect). A reachability
  watcher (profile.get probe) and any successful traffic clear the signal.
- the old red error.unavailable toast is gone (handleError suppresses connection codes;
  the indicator replaces it). A server-data screen still opens with the spinner and
  fills on reconnect (global indicator + read auto-retry), so navigation is never dead.
- pure retry policy unit-tested (retry.ts); a mock-only window.__conn hook drives a
  Chromium+WebKit e2e (indicator shows offline, the action disables, both clear on
  reconnect). Full suite + build green.
- docs: ARCHITECTURE transport note, FUNCTIONAL (+ _ru), PLAN tracker (incl. #1 — the
  bot already drains all updates, no change).

Also records #1 as investigated/no-change in PLAN. Other server-action buttons (chat
send, profile save, …) still degrade to a safe no-op offline; visual disable is easy to
extend.

docs/ARCHITECTURE.md

@@ -89,7 +89,15 @@ dropped). Horizontal scaling is explicit future work.
   auth operations are unauthenticated and return the minted token. A unary
   operation's domain outcome rides back in `ExecuteResponse.result_code` (HTTP
   200); only edge failures (rate limit, missing session, unknown type, internal)
-  surface as Connect error codes.
+  surface as Connect error codes. The client (Stage 17) treats a connectivity edge failure as
+  **state, not a per-call toast**: a transport `unavailable` or a `rate_limited` flips a global
+  `online` signal that drives a header **"Connecting…"** spinner and softly disables proactive
+  actions, and the transport **auto-retries with capped exponential backoff** — every op on a
+  rate-limit (the gateway rejected it before processing, so it is safe), but only **read-only**
+  ops on `unavailable` (a mutation is never blindly re-sent, to avoid double-applying one whose
+  response was lost — its button is disabled while offline and the player re-issues it on
+  reconnect). A reachability watcher (a lightweight `profile.get` probe) clears the signal when no
+  other traffic is in flight; the live `Subscribe` stream's drop/recovery feeds the same signal.
 - **Alphabet on the wire (Stage 13)**: live play exchanges **alphabet indices**, not
   concrete letters. The rack (`StateView.rack`), the `SubmitPlay`/`Evaluate` tiles, the
   `Exchange` tiles and the `CheckWord` word are `ubyte` indices into the variant's alphabet

docs/FUNCTIONAL.md

@@ -46,7 +46,12 @@ request) arrive as a **Telegram notification** instead — unless the player kee
 notifications in the app only (a profile setting, **on by default**). The "your turn"
 notification names the opponent and recaps their last move — the word and the running score
 for a scoring play, or that they swapped or passed — and a finished game sends a "game over"
-notification with your result and the final score (scores read with yours first).
+notification with your result and the final score (scores read with yours first). If the
+connection drops or the server is rate-limiting, the app does not nag with errors: the header
+shows a quiet **"Connecting…"** spinner while it reconnects, actions that send to the server
+pause until it is back (a server-data screen still opens, with the spinner, and fills in on
+reconnect), and pending reads resume on their own — the interface stays usable instead of
+flashing a red banner each time.
 
 ### Accounts, linking & merge *(Stage 1 / 11)*
 First platform contact auto-provisions a durable account. From the profile a player

docs/FUNCTIONAL_ru.md

@@ -48,7 +48,12 @@ Mini App** авторизует по подписанным `initData` плат
 Уведомление «ваш ход» называет соперника и пересказывает его последний ход — слово и
 текущий счёт для результативного хода либо что он поменял фишки или пропустил, — а по
 завершении партии приходит уведомление «конец партии» с твоим результатом и финальным
-счётом (счёт читается, твой первым).
+счётом (счёт читается, твой первым). Если связь пропадает или сервер ограничивает частоту
+запросов, приложение не донимает ошибками: в шапке тихо крутится спиннер **«Подключение…»**,
+пока идёт переподключение, действия, отправляющие данные на сервер, приостанавливаются до
+восстановления связи (экран с серверными данными всё равно открывается — со спиннером — и
+подгружается при реконнекте), а незавершённые чтения возобновляются сами — интерфейс остаётся
+рабочим вместо красного баннера каждый раз.
 
 ### Аккаунты, привязка и слияние *(Stage 1 / 11)*
 Первый контакт с платформы заводит постоянный аккаунт. Из профиля игрок