Stage 17 round 6 (#4/#5/#6): draft persistence wire + gateway + UI

Complete the client-side draft feature on top of the shipped backend
foundation (the game_drafts store/service):

- FB: DraftRequest{game_id,json} + DraftView{json} (a draft get reuses
  GameActionRequest); regenerated committed Go + TS bindings.
- Backend REST: GET/PUT /games/:id/draft, a draftDTO
  (rack_order/board_tiles) mapped to game.Draft.
- Gateway: draft.get/draft.save transcode forwarding the composition
  JSON verbatim (json.RawMessage both ways -- no double-encode).
- UI: debounced save of the rack order + board tiles and restore on
  load (lib/draft.ts), plus #5 -- tiles may be arranged on the
  opponent's turn (placement relaxed; the preview and Make-move stay
  your-turn-only, so an off-turn draft is position-only).

Tests: backend handler validation, gateway pass-through round-trip, UI
draft/codec units, and a draft-restore e2e.

ui/e2e/game.spec.ts

@@ -29,6 +29,21 @@ test('placing a tile and confirming via ✅ commits the move', async ({ page })
   await expect(page.locator('.make')).toBeHidden();
 });
 
+test('a placed tile is saved as a draft and restored on reopening the game', async ({ page }) => {
+  await openGame(page);
+  await page.locator('.rack .tile').first().click();
+  await page.locator('[data-cell]:not(.filled)').nth(30).click();
+  await expect(page.locator('[data-cell].pending')).toHaveCount(1);
+  await page.waitForTimeout(600); // let the debounced draft save flush to the mock store
+
+  // Leave the game and reopen it. The mock keeps the saved composition, so the pending tile is
+  // restored without re-placing it (Stage 17 #4/#6).
+  await page.evaluate(() => (location.hash = '/'));
+  await page.getByRole('button', { name: /Ann/ }).click();
+  await expect(page.locator('[data-cell]').first()).toBeVisible();
+  await expect(page.locator('[data-cell].pending')).toHaveCount(1);
+});
+
 test('new game: variant buttons show a rules summary and the move-limit', async ({ page }) => {
   await page.goto('/');
   await page.getByRole('button', { name: /guest/i }).click();