Game/Telegram review polish: USSR flag, touch drag ghost, TG fullscreen header

Backlog item 2 of ~4 (owner review pass):
- USSR flag emblem redrawn (canonical hammer & sickle, scaled down 1.5x
  below the star).
- Touch drag-and-drop: enlarge the drag ghost 1.5x on touch only (the finger
  hides the tile); suppress the iOS tap-highlight that lingered on a rack tile
  sliding into a dragged tile's slot.
- Telegram fullscreen: its native nav no longer hides our header -- the header
  drops below the content-safe-area top inset and the menu (hamburger) lifts
  into the nav band, centred (--tg-content-top from the SDK inset + a
  tg-fullscreen class; new telegram.ts helper + app wiring).

Tests: UI check/test:unit/build + full e2e (60) green. The iOS tap-highlight
fix and the TG-fullscreen layout want on-device verification on the deploy.

ui/src/lib/app.svelte.ts

@@ -13,6 +13,7 @@ import {
   insideTelegram,
   onTelegramPath,
   telegramColorScheme,
+  telegramContentSafeAreaTop,
   telegramDisableVerticalSwipes,
   telegramHaptic,
   telegramLaunch,
@@ -227,6 +228,19 @@ function syncTelegramChrome(): void {
   );
 }
 
+/**
+ * syncTelegramSafeArea mirrors Telegram's content-safe-area top inset (the height its native
+ * nav overlays the viewport in fullscreen) into the --tg-content-top CSS var and toggles a
+ * `tg-fullscreen` class, so the header can drop below the nav and lift the menu into its
+ * band (Stage 17). Called on launch and on Telegram's safe-area / fullscreen change events.
+ */
+function syncTelegramSafeArea(): void {
+  if (typeof document === 'undefined') return;
+  const top = telegramContentSafeAreaTop();
+  document.documentElement.style.setProperty('--tg-content-top', `${top}px`);
+  document.documentElement.classList.toggle('tg-fullscreen', top > 0);
+}
+
 export async function bootstrap(): Promise<void> {
   const prefs = await loadPrefs();
   app.theme = prefs.theme ?? 'auto';
@@ -263,6 +277,9 @@ export async function bootstrap(): Promise<void> {
     // Match Telegram's chrome to the app and stop its swipe-down-to-minimise from
     // fighting tile drag / board scroll.
     syncTelegramChrome();
+    syncTelegramSafeArea();
+    telegramOnEvent('contentSafeAreaChanged', syncTelegramSafeArea);
+    telegramOnEvent('fullscreenChanged', syncTelegramSafeArea);
     telegramDisableVerticalSwipes();
     try {
       await adoptSession(await gateway.authTelegram(launch.initData));

ui/src/lib/telegram.ts

@@ -10,6 +10,8 @@ interface TelegramWebApp {
   initDataUnsafe?: { start_param?: string };
   themeParams?: TelegramThemeParams;
   colorScheme?: 'light' | 'dark';
+  isFullscreen?: boolean;
+  contentSafeAreaInset?: { top: number; bottom: number; left: number; right: number };
   ready?: () => void;
   expand?: () => void;
   onEvent?: (event: string, handler: () => void) => void;
@@ -99,6 +101,15 @@ export function telegramSetChrome(header: string, background: string, bottom: st
   if (bottom) w?.setBottomBarColor?.(bottom);
 }
 
+/**
+ * telegramContentSafeAreaTop returns the height (px) Telegram's own UI overlays at the top of
+ * the viewport in fullscreen (its nav band; the content-safe area, Bot API 8.0). It is 0
+ * outside Telegram or on clients predating it, so callers can pad/position defensively.
+ */
+export function telegramContentSafeAreaTop(): number {
+  return webApp()?.contentSafeAreaInset?.top ?? 0;
+}
+
 /**
  * telegramDisableVerticalSwipes turns off Telegram's swipe-down-to-minimise gesture so
  * it does not fight tile drag-and-drop or the board's vertical scroll.