feat(ui): diagnostic screen on /telegram/ instead of the landing bounce

A Mini App launch on /telegram/ without sign-in data (empty initData) used to
location.replace('/') — bouncing the visitor to the marketing landing. That
destroyed all diagnosability and, on some Android clients that reach the entry
with no initData, simply looked like the app refusing to open.

Replace the bounce with a compact, privacy-safe launch-error screen
(screens/TelegramLaunchError.svelte) that renders a one-screenshot diagnostic
snapshot captured at the moment of failure: SDK/WebApp presence, Telegram
platform/version, whether initData is empty, whether the URL fragment carried
tgWebAppData, the initData field NAMES present/missing (never the signed
values, never an IP), and OS/mobile/browser via User-Agent Client Hints plus
the full User-Agent. A Share button delivers it through the OS share sheet
(clipboard copy on desktop, reusing the GCG no-webview-strand guard); Retry
re-checks in place to recover a late initData without a reload (which would
discard the launch fragment).

This is the instrument to root-cause the Android empty-initData failure, which
is not reproducible in Playwright.

Tests: collectTelegramDiag + shareText/pickTextShare unit tests; the /telegram/
e2e now asserts the diagnostic screen, not a redirect. Docs: ARCHITECTURE.md +
UI_DESIGN.md updated.

ui/src/lib/app.svelte.ts

@@ -12,6 +12,8 @@ import { languageNeedsServerSync } from './language';
 import { applyReduceMotion, applyTelegramTheme, applyTheme, type ThemePref } from './theme';
 import {
   insideTelegram,
+  collectTelegramDiag,
+  type TelegramDiag,
   onTelegramPath,
   telegramColorScheme,
   telegramContentSafeAreaTop,
@@ -47,6 +49,11 @@ export const app = $state<{
    *  backend was down during a deploy). App.svelte then renders the boot-error retry screen
    *  instead of the web login — a Mini App has no manual sign-in to fall back to. */
   bootError: boolean;
+  /** On the dedicated /telegram/ entry, set to a privacy-safe diagnostic snapshot when a Mini App
+   *  launch carried no sign-in data (empty initData). App.svelte then renders the compact
+   *  launch-error screen (screens/TelegramLaunchError) — a shareable probe for why Telegram
+   *  delivered no initData (seen on some Android clients) — instead of bouncing to the landing. */
+  launchError: TelegramDiag | null;
   /** Whether the lobby's first cold load has settled (success or error). The loading splash
    *  (components/Splash.svelte) watches it to know when to dismiss; set by screens/Lobby. */
   lobbyReady: boolean;
@@ -96,6 +103,7 @@ export const app = $state<{
 }>({
   ready: false,
   bootError: false,
+  launchError: null,
   lobbyReady: false,
   splashDone: false,
   streamAlive: false,
@@ -530,6 +538,29 @@ function syncViewportHeight(): void {
   if (h > 0) document.documentElement.style.setProperty('--vvh', `${h}px`);
 }
 
+/**
+ * applyTelegramChrome applies a Mini App launch's visual integration: Telegram's authoritative
+ * colour scheme and theme, the matching header / background / bottom chrome, the safe-area insets,
+ * the swipe-down guard, and immersive fullscreen on mobile. It is idempotent, so both the initial
+ * bootstrap and a manual launch retry call it.
+ */
+function applyTelegramChrome(launch: TelegramLaunch): void {
+  if (launch.theme) applyTelegramTheme(launch.theme);
+  // Inside Telegram the colour scheme is Telegram's to decide; force it explicitly so the OS
+  // prefers-color-scheme (which leaks into the Telegram Desktop webview) cannot fight it. Falls
+  // back to the stored preference when the SDK omits it.
+  applyTheme(telegramColorScheme() ?? app.theme);
+  // Match Telegram's chrome to the app and stop its swipe-down-to-minimise from fighting tile
+  // drag / board scroll.
+  syncTelegramChrome();
+  syncTelegramSafeArea();
+  telegramDisableVerticalSwipes();
+  // On mobile, go immersive fullscreen like Telegram's own Mini Apps; the fullscreenChanged
+  // listener (registered at bootstrap) then re-syncs the safe-area insets. Desktop keeps the bot's
+  // full-size window. No-op on clients predating Bot API 8.0.
+  telegramRequestFullscreen();
+}
+
 export async function bootstrap(): Promise<void> {
   const prefs = await loadPrefs();
   app.theme = prefs.theme ?? 'auto';
@@ -553,33 +584,23 @@ export async function bootstrap(): Promise<void> {
     window.visualViewport.addEventListener('scroll', syncViewportHeight);
   }
 
-  // Telegram Mini App launch: apply the platform theme, authenticate via initData,
-  // and route any deep-link start parameter. On the dedicated /telegram/ entry path
-  // outside Telegram (no initData), refuse to render and send the visitor to the
-  // site root.
+  // Telegram Mini App launch: apply the platform theme, authenticate via initData, and route any
+  // deep-link start parameter. On the dedicated /telegram/ entry without sign-in data (no/empty
+  // initData — outside Telegram, or a Mini App launch that delivered none, as seen on some Android
+  // clients), render the compact launch-error screen with a diagnostic snapshot the user can share
+  // with the developer, instead of bouncing the visitor to the marketing landing.
   if (onTelegramPath() && !insideTelegram()) {
-    if (typeof location !== 'undefined') location.replace('/');
+    app.launchError = collectTelegramDiag();
+    app.ready = true;
     return;
   }
   if (insideTelegram()) {
     const launch = telegramLaunch();
-    if (launch.theme) applyTelegramTheme(launch.theme);
-    // Inside Telegram the colour scheme is Telegram's to decide; force it explicitly
-    // so the OS prefers-color-scheme (which leaks into the Telegram Desktop webview)
-    // cannot fight it. Falls back to the stored preference when the SDK omits it.
-    applyTheme(telegramColorScheme() ?? app.theme);
-    // Match Telegram's chrome to the app and stop its swipe-down-to-minimise from
-    // fighting tile drag / board scroll.
-    syncTelegramChrome();
-    syncTelegramSafeArea();
+    applyTelegramChrome(launch);
+    // Re-sync the safe-area insets whenever Telegram's chrome changes (registered once per load).
     telegramOnEvent('contentSafeAreaChanged', syncTelegramSafeArea);
     telegramOnEvent('safeAreaChanged', syncTelegramSafeArea);
     telegramOnEvent('fullscreenChanged', syncTelegramSafeArea);
-    telegramDisableVerticalSwipes();
-    // On mobile, go immersive fullscreen like Telegram's own Mini Apps; the fullscreenChanged
-    // listener above then re-syncs the safe-area insets. Desktop keeps the bot's full-size
-    // window. No-op on clients predating Bot API 8.0.
-    telegramRequestFullscreen();
     await bootTelegram(launch);
     app.ready = true;
     return;
@@ -646,6 +667,26 @@ export async function retryTelegramBoot(): Promise<void> {
   app.ready = true;
 }
 
+/**
+ * retryTelegramLaunch re-attempts a Mini App launch from the launch-error screen's Retry button. If
+ * sign-in data is present now (e.g. it arrived late on a slow client) it clears the error and runs
+ * the normal launch; otherwise it refreshes the diagnostic snapshot so the screen reflects the
+ * current state. It never reloads — telegram-web-app.js consumes the launch fragment on first load,
+ * so a reload could discard the very data we are waiting for.
+ */
+export async function retryTelegramLaunch(): Promise<void> {
+  if (!insideTelegram()) {
+    app.launchError = collectTelegramDiag();
+    return;
+  }
+  app.launchError = null;
+  app.ready = false;
+  const launch = telegramLaunch();
+  applyTelegramChrome(launch);
+  await bootTelegram(launch);
+  app.ready = true;
+}
+
 /**
  * routeStartParam navigates a Telegram deep-link start parameter to its target: a
  * specific game, the friends screen with a friend-code redemption, or the lobby