Stage 17 round 6 (#4/#5/#6): draft persistence wire + gateway + UI

Complete the client-side draft feature on top of the shipped backend
foundation (the game_drafts store/service):

- FB: DraftRequest{game_id,json} + DraftView{json} (a draft get reuses
  GameActionRequest); regenerated committed Go + TS bindings.
- Backend REST: GET/PUT /games/:id/draft, a draftDTO
  (rack_order/board_tiles) mapped to game.Draft.
- Gateway: draft.get/draft.save transcode forwarding the composition
  JSON verbatim (json.RawMessage both ways -- no double-encode).
- UI: debounced save of the rack order + board tiles and restore on
  load (lib/draft.ts), plus #5 -- tiles may be arranged on the
  opponent's turn (placement relaxed; the preview and Make-move stay
  your-turn-only, so an off-turn draft is position-only).

Tests: backend handler validation, gateway pass-through round-trip, UI
draft/codec units, and a draft-restore e2e.

gateway/internal/transcode/transcode_draft_test.go

@@ -0,0 +1,82 @@
+package transcode_test
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"testing"
+
+	flatbuffers "github.com/google/flatbuffers/go"
+
+	"scrabble/gateway/internal/transcode"
+	fb "scrabble/pkg/fbs/scrabblefb"
+)
+
+// TestDraftSaveForwardsRawJSON checks the save handler forwards the client's composition JSON
+// to the backend verbatim (the "no double-encode" contract, Stage 17) with the user header.
+func TestDraftSaveForwardsRawJSON(t *testing.T) {
+	const body = `{"rack_order":"1,0","board_tiles":[{"row":7,"col":7,"letter":"Q","blank":false}]}`
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPut || r.URL.Path != "/api/v1/user/games/g-1/draft" {
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+		}
+		if got := r.Header.Get("X-User-ID"); got != "u-3" {
+			t.Errorf("X-User-ID = %q, want u-3", got)
+		}
+		raw, _ := io.ReadAll(r.Body)
+		if string(raw) != body {
+			t.Errorf("forwarded body = %q, want %q (verbatim)", raw, body)
+		}
+		_, _ = w.Write([]byte(`{"ok":true}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, ok := reg.Lookup(transcode.MsgDraftSave)
+	if !ok {
+		t.Fatal("draft.save not registered")
+	}
+
+	b := flatbuffers.NewBuilder(64)
+	gid := b.CreateString("g-1")
+	j := b.CreateString(body)
+	fb.DraftRequestStart(b)
+	fb.DraftRequestAddGameId(b, gid)
+	fb.DraftRequestAddJson(b, j)
+	b.Finish(fb.DraftRequestEnd(b))
+
+	if _, err := op.Handler(context.Background(), transcode.Request{Payload: b.FinishedBytes(), UserID: "u-3"}); err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+}
+
+// TestDraftGetWrapsBackendJSON checks the get handler wraps the backend's stored draft JSON in
+// a DraftView verbatim (the gateway never interprets the shape).
+func TestDraftGetWrapsBackendJSON(t *testing.T) {
+	const stored = `{"rack_order":"2,0,1","board_tiles":[]}`
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodGet || r.URL.Path != "/api/v1/user/games/g-2/draft" {
+			t.Errorf("unexpected %s %s", r.Method, r.URL.Path)
+		}
+		_, _ = w.Write([]byte(stored))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil)
+	op, _ := reg.Lookup(transcode.MsgDraftGet)
+
+	b := flatbuffers.NewBuilder(32)
+	gid := b.CreateString("g-2")
+	fb.GameActionRequestStart(b)
+	fb.GameActionRequestAddGameId(b, gid)
+	b.Finish(fb.GameActionRequestEnd(b))
+
+	payload, err := op.Handler(context.Background(), transcode.Request{Payload: b.FinishedBytes(), UserID: "u-4"})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	v := fb.GetRootAsDraftView(payload, 0)
+	if string(v.Json()) != stored {
+		t.Fatalf("DraftView.json = %q, want %q (verbatim)", v.Json(), stored)
+	}
+}