v5.0.0: protocol v5 and the browser frontend

Protocol v5 replaces newline lines with bounded [u32 len][text] frames and REQ/RES/EVT envelopes. Requests carry correlation ids and the server replays the last 256 replies per connection, so a gateway retry cannot double-debit and a late reply cannot clobber a newer request. HELLO/PONG carry server time; crash rounds announce started_at and push coalesced 10 Hz ticks. Crash now commits sha256(seed) before a round and reveals the seed when it ends, so clients recompute the crash point.

Adds the webd/ gateway: one blocking thread, one ClientCore and one pinned upstream TLS connection per session, an HttpOnly session cookie, takeover, and a 60-second grace window. The browser sends Command JSON and renders View JSON; it never speaks the game protocol or stores credentials.

Adds the vanilla TypeScript browser app at /play/ (login, lobby, all four games, history, notices, crash verification), the nginx /play and /ws routes, and the headless DOM smoke test. webd and the app stay out of the TUI/GUI/server build graph.

The client/server version moves to 5.0.0 in lockstep; v4 peers are refused at HELLO.

1 files changed, 4 insertions, 1 deletions

diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index c0370a0..95ec922 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -5,7 +5,10 @@ Decisions and rationale live in `docs/adr/0001-gui-frontend-architecture.md` and
 
 ## Non-goals
 
-Audio, 3D, macOS, auto-update, a browser client, and pixel-golden tests in CI.
+Audio, 3D, macOS, auto-update, a webview inside the desktop app, and
+pixel-golden tests in CI. A separate browser frontend is no longer a non-goal:
+it shipped in v5.0.0 through the `webd/` gateway, planned in
+`docs/WEB-PLAN.md`.
 
 ## Phase 0 — version handshake (v4.0.0)