Stage 17 round 6 (#4/#5/#6): draft persistence wire + gateway + UI

Complete the client-side draft feature on top of the shipped backend
foundation (the game_drafts store/service):

- FB: DraftRequest{game_id,json} + DraftView{json} (a draft get reuses
  GameActionRequest); regenerated committed Go + TS bindings.
- Backend REST: GET/PUT /games/:id/draft, a draftDTO
  (rack_order/board_tiles) mapped to game.Draft.
- Gateway: draft.get/draft.save transcode forwarding the composition
  JSON verbatim (json.RawMessage both ways -- no double-encode).
- UI: debounced save of the rack order + board tiles and restore on
  load (lib/draft.ts), plus #5 -- tiles may be arranged on the
  opponent's turn (placement relaxed; the preview and Make-move stay
  your-turn-only, so an off-turn draft is position-only).

Tests: backend handler validation, gateway pass-through round-trip, UI
draft/codec units, and a draft-restore e2e.

backend/internal/server/handlers_test.go

@@ -73,3 +73,28 @@ func TestSubmitPlayRejectsBadGameID(t *testing.T) {
 		t.Fatalf("submit play bad game id = %d, want 400", rec.Code)
 	}
 }
+
+func TestGetDraftRequiresUserID(t *testing.T) {
+	path := "/api/v1/user/games/" + uuid.New().String() + "/draft"
+	rec := do(t, newRoutingServer(), http.MethodGet, path, "", nil)
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("get draft without X-User-ID = %d, want 401", rec.Code)
+	}
+}
+
+func TestSaveDraftRejectsBadGameID(t *testing.T) {
+	headers := map[string]string{"X-User-ID": uuid.New().String()}
+	rec := do(t, newRoutingServer(), http.MethodPut, "/api/v1/user/games/not-a-uuid/draft", `{"rack_order":"","board_tiles":[]}`, headers)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("save draft bad game id = %d, want 400", rec.Code)
+	}
+}
+
+func TestSaveDraftRejectsBadBody(t *testing.T) {
+	headers := map[string]string{"X-User-ID": uuid.New().String()}
+	path := "/api/v1/user/games/" + uuid.New().String() + "/draft"
+	rec := do(t, newRoutingServer(), http.MethodPut, path, `not json`, headers)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("save draft bad body = %d, want 400", rec.Code)
+	}
+}