feat(account): VK ID web login to link a VK identity from a browser

A browser has no signed VK Mini App launch params, so linking VK on the web uses
VK ID's raw OAuth 2.1 flow (PKCE, no @vkid/sdk): the SPA redirects to VK's hosted
login and returns with an authorization code, which the gateway exchanges
server-side (confidential, under the VK "Web" app's protected key) for the trusted
vk user id — then the existing link/merge machinery attaches or merges it.

- fbs LinkVKRequest{code, device_id, code_verifier}; codec + TS bindings.
- backend link.Service ConfirmVK/MergeVK/attachVK (KindVK, mirror Telegram),
  handleLinkVK[Merge], routes /user/link/vk[/merge], backendclient LinkVK[Merge].
- gateway internal/vkid confidential code exchange (id.vk.com/oauth2/auth);
  transcode link.vk.confirm/merge (registered only when configured) + config
  GATEWAY_VK_ID_{APP_ID,CLIENT_SECRET,REDIRECT_URL} + main wiring.
- UI lib/vkid (PKCE authorize redirect + callback), Profile "Link VK" control,
  boot callback handling; a merge re-authorizes for a fresh code (VK codes are
  single-use). Web-only (a redirect strands a Mini App webview).
- Deploy: VITE_VK_APP_ID + VITE_VK_ID_REDIRECT_URL build args + gateway env,
  ci.yaml/prod-deploy TEST_/PROD_ vars, compose/Dockerfile/.env.example/README.
- Tests: vkid exchange unit (string/number user_id, id_token fallback, errors),
  transcode link.vk, backend ConfirmVK/MergeVK inttest, codec encodeLinkVK.
- Docs: ARCHITECTURE §4, FUNCTIONAL(+ru), gateway README.

.gitea/workflows/prod-deploy.yaml

@@ -41,6 +41,9 @@ jobs:
       VITE_TELEGRAM_LINK: ${{ vars.PROD_VITE_TELEGRAM_LINK }}
       VITE_TELEGRAM_GAME_CHANNEL_NAME: ${{ vars.PROD_VITE_TELEGRAM_GAME_CHANNEL_NAME }}
       VITE_VK_APP_LINK: ${{ vars.PROD_VITE_VK_APP_LINK }}
+      # VK ID web login: the "Web" app id + trusted redirect URL, baked into the SPA authorize URL.
+      VITE_VK_APP_ID: ${{ vars.PROD_VITE_VK_APP_ID }}
+      VITE_VK_ID_REDIRECT_URL: ${{ vars.PROD_VK_ID_REDIRECT_URL }}
       VITE_GATEWAY_URL: ${{ vars.PROD_VITE_GATEWAY_URL }}
       POSTGRES_PASSWORD: ${{ secrets.PROD_POSTGRES_PASSWORD }}
       GM_BASICAUTH_HASH: ${{ secrets.PROD_GM_BASICAUTH_HASH }}
@@ -84,6 +87,11 @@ jobs:
       GRAFANA_ADMIN_PASSWORD: ${{ secrets.PROD_GRAFANA_ADMIN_PASSWORD }}
       TELEGRAM_BOT_TOKEN: ${{ secrets.PROD_TELEGRAM_BOT_TOKEN }}
       GATEWAY_VK_APP_SECRET: ${{ secrets.PROD_GATEWAY_VK_APP_SECRET }}
+      # VK ID web login: the SPA app id + redirect URL (the gateway reuses them as its
+      # client_id / exchange redirect_uri at runtime) and the "Web" app's protected key.
+      VITE_VK_APP_ID: ${{ vars.PROD_VITE_VK_APP_ID }}
+      VITE_VK_ID_REDIRECT_URL: ${{ vars.PROD_VK_ID_REDIRECT_URL }}
+      GATEWAY_VK_ID_CLIENT_SECRET: ${{ secrets.PROD_GATEWAY_VK_ID_CLIENT_SECRET }}
       # Signs the finished-game export download URLs (backend BACKEND_EXPORT_SIGN_KEY).
       EXPORT_SIGN_KEY: ${{ secrets.PROD_EXPORT_SIGN_KEY }}
       # Transactional email via the shared Selectel relay (confirm-codes).
@@ -167,6 +175,11 @@ jobs:
           export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
           export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
           export GATEWAY_VK_APP_SECRET='$GATEWAY_VK_APP_SECRET'
+          # VK ID web login: needed at runtime — the gateway's GATEWAY_VK_ID_* env resolves
+          # its app id / redirect URL from these VITE_ values (one source, shared with the SPA).
+          export VITE_VK_APP_ID='$VITE_VK_APP_ID'
+          export VITE_VK_ID_REDIRECT_URL='$VITE_VK_ID_REDIRECT_URL'
+          export GATEWAY_VK_ID_CLIENT_SECRET='$GATEWAY_VK_ID_CLIENT_SECRET'
           export EXPORT_SIGN_KEY='$EXPORT_SIGN_KEY'
           export SMTP_RELAY_HOST='$SMTP_RELAY_HOST'
           export SMTP_RELAY_PORT='$SMTP_RELAY_PORT'