build: package the game as a container image and wire CI

One distroless image of about 25 MB carries the binary, the built frontend and
the derived dictionary. The 179 MB upstream release is downloaded in a builder
stage and never reaches the final image; the derived wordlist is copied in as
its own layer alongside its licence, attribution and notice, because CC BY-SA
4.0 applies wherever that data is distributed and an image is distribution.

FIXTURE_DICT=1 builds the same Dockerfile against the checked-in word sample,
so the image is built and smoke-tested on every push rather than only at
release. An image built only at release time is an image that breaks at release
time.

CI runs the Go suite under race detection, the frontend type check and tests,
the browser suite, and the image with its licence assertions. The wire contract
keeps its own workflow; the test steps it duplicated were removed from it.

docs/deployment.md covers configuration, the reverse-proxy settings that each
break the game in a way that looks like something else, and what a restart
costs.

.github/workflows/proto.yml

@@ -1,8 +1,8 @@
-# Guards the WebSocket wire contract.
+# Guards the WebSocket wire contract: the schema is well-formed, it has not
+# broken compatibility, and the committed generated code matches it.
 #
-# Nothing here downloads the 179 MB upstream dictionary: the wire types and
-# their fixtures are independent of the wordlist, so this workflow stays fast
-# and runs on every push.
+# The suites that decode the cross-language fixtures run in ci.yml, where the
+# rest of the tests are. Nothing here downloads the 179 MB upstream dictionary.
 name: proto
 
 on:
@@ -72,13 +72,3 @@ jobs:
           buf generate
           git add --intent-to-add -- server/gen web/src/lib/proto
           git diff --exit-code -- server/gen web/src/lib/proto
-
-      # Both suites read the same fixtures in proto/testdata, so this is what
-      # actually proves Go and JavaScript agree on the bytes.
-      - name: Go wire tests
-        run: go test ./internal/wsapi/... -race
-        working-directory: server
-
-      - name: JavaScript wire tests
-        run: npm test
-        working-directory: web