Stage 16: insert Stage 17 (test-contour verification); renumber prod deploy to 18

- PLAN.md: new Stage 17 "Test-contour verification & defect fixes" (exercise the
  deployed contour end-to-end and fix what it surfaces — connector liveness check,
  path-conditional CI); the former prod-deploy stage becomes Stage 18.
- Renumber every "Stage 17" prod-deploy reference to "Stage 18" across docs,
  compose, Caddyfile, ci.yaml and CLAUDE.md; the post-Stage-14 split range is now
  "Stages 15–18".

deploy/.env.example

@@ -1,5 +1,5 @@
 # Environment for deploy/docker-compose.yml. The CI deploy job (ci.yaml) maps the
-# Gitea TEST_-prefixed secrets/variables onto these unprefixed names; Stage 17
+# Gitea TEST_-prefixed secrets/variables onto these unprefixed names; Stage 18
 # maps the PROD_-prefixed set the same way. Copy to deploy/.env for a local run.
 #
 # Full reference (required vs optional, defaults, secret-vs-variable): deploy/README.md.
@@ -17,7 +17,7 @@ LOG_LEVEL=info
 
 # --- Edge / caddy -----------------------------------------------------------
 # Test: ":80" (the host caddy terminates TLS and forwards to scrabble:80 on the
-# external `edge` network). Prod (Stage 17): a domain so caddy does its own ACME.
+# external `edge` network). Prod (Stage 18): a domain so caddy does its own ACME.
 CADDY_SITE_ADDRESS=:80
 GM_BASICAUTH_USER=gm
 GM_BASICAUTH_HASH=                     # required; `caddy hash-password` bcrypt hash

deploy/README.md

@@ -38,7 +38,7 @@ cd deploy && docker compose up -d --build
 
 **In CI** (the test contour) — `.gitea/workflows/ci.yaml`'s `deploy` job maps the
 Gitea **`TEST_`-prefixed** secrets/variables onto the unprefixed names below and
-runs `docker compose up -d --build` on the runner host. Stage 17 (prod) maps the
+runs `docker compose up -d --build` on the runner host. Stage 18 (prod) maps the
 **`PROD_`** set the same way. So a Gitea secret named `TEST_POSTGRES_PASSWORD`
 feeds the compose's `POSTGRES_PASSWORD`, etc.
 
@@ -71,7 +71,7 @@ connector **fails at boot** if both are empty.
 | `GRAFANA_ADMIN_PASSWORD` | secret | `admin` | Grafana admin password. Low impact (the login form is disabled, access is anonymous-admin behind caddy) but set it anyway. |
 | `TELEGRAM_GAME_CHANNEL_ID_EN` | variable | _(empty)_ | English game-channel id; empty/`0` disables channel posts. |
 | `TELEGRAM_GAME_CHANNEL_ID_RU` | variable | _(empty)_ | Russian game-channel id; empty/`0` disables channel posts. |
-| `TELEGRAM_TEST_ENV` | _pinned_ | `false` | `true` routes the bot through Telegram's test environment (`.../bot<token>/test/METHOD`). **The CI test contour pins this to `true` in `ci.yaml`** (the contour is the test environment) — it is not a Gitea variable. Set it in `.env` for a local run; prod (Stage 17) leaves it `false`. |
+| `TELEGRAM_TEST_ENV` | _pinned_ | `false` | `true` routes the bot through Telegram's test environment (`.../bot<token>/test/METHOD`). **The CI test contour pins this to `true` in `ci.yaml`** (the contour is the test environment) — it is not a Gitea variable. Set it in `.env` for a local run; prod (Stage 18) leaves it `false`. |
 | `TELEGRAM_API_BASE_URL` | variable | _(empty)_ | Override the Bot API host (a mock/self-hosted server); empty = `https://api.telegram.org`. |
 | `GATEWAY_DEFAULT_SUPPORTED_LANGUAGES` | variable | `en,ru` | Variant-gating set for non-Telegram logins (web/email/guest). |
 | `VITE_TELEGRAM_BOT_ID` | variable | _(empty)_ | UI build-arg: numeric bot id for the web Login Widget. |

deploy/caddy/Caddyfile

@@ -4,7 +4,7 @@
 # Connect edge) goes to the gateway. Mirrors ../galaxy-game's /_gm model.
 #
 # CADDY_SITE_ADDRESS is ":80" in the test contour (the host caddy terminates TLS
-# and forwards); set it to a domain in prod (Stage 17) so this caddy does its own
+# and forwards); set it to a domain in prod (Stage 18) so this caddy does its own
 # ACME and the contour is self-contained.
 {
 	admin off

deploy/docker-compose.yml

@@ -11,7 +11,7 @@
 #   - `edge` (external): the host caddy reaches this contour at `scrabble:80`
 #     (the in-compose caddy's alias). The in-compose caddy terminates only HTTP in
 #     the test contour; the host caddy terminates TLS and forwards. For prod
-#     (Stage 17, no host caddy) set CADDY_SITE_ADDRESS to the domain so the caddy
+#     (Stage 18, no host caddy) set CADDY_SITE_ADDRESS to the domain so the caddy
 #     does its own ACME — the contour is then self-contained.
 #   - The connector egresses to api.telegram.org through the `vpn` sidecar
 #     (network_mode: service:vpn); it answers internal gRPC at `telegram:9091`.