feat(ui): drop Telegram fullscreen; own back chevron everywhere; hidden debug panel

Finalises the Telegram Mini App navigation work after on-device testing (Pixel
10 / Android 17 + iOS, fresh beta clients):

- Remove requestFullscreen entirely. Immersive fullscreen hid Telegram's native
  header (and its BackButton) and the Android system swipe-back minimised the
  app; the owner prefers the windowed full-size (expand) presentation, so the
  app never requests fullscreen on any platform now.
- The app's own back chevron (Header, showBack = !!back) drives back-navigation
  on every platform; the native Telegram BackButton is dropped — it does not
  render in the windowed Mini App (backVisible=false on iOS and Android), so
  relying on it lost back navigation (notably none on iOS).
- Replace the temporary always-on diagnostic overlay with a hidden debug panel
  (components/DebugPanel): ten quick taps on the header title open it; it shows a
  privacy-safe client diagnostic snapshot (app version, locale, online, userId,
  Telegram chrome / viewport / SDK state — no secrets, no IP) and shares it via
  the OS share sheet / clipboard; a tap anywhere except Share dismisses it.
- Drop the now-dead telegramRequestFullscreen / telegramBackButton /
  isTelegramAndroid helpers and the iOS-fullscreen unit test.

Telegram has no native non-modal notification API (only modal showPopup /
showAlert), so in-app toasts stay ours. Docs: UI_DESIGN.md.

docs/UI_DESIGN.md

@@ -97,14 +97,16 @@ dismisses as soon as the lobby is ready. The pure layout and timing live in `lib
   which leaks into the Telegram Desktop webview and otherwise fights it) and the Settings
   theme switcher is hidden; the nav bar takes Telegram's background and `setHeaderColor` /
   `setBackgroundColor` / `setBottomBarColor` paint Telegram's own chrome to match; the
-  native header **BackButton** drives back-navigation (the app's chevron is hidden in
-  Telegram); **HapticFeedback** fires on tile placement / commit / error; on **iOS** the app
-  enters **immersive fullscreen** on launch (`requestFullscreen`, Bot API 8.0+) like Telegram's
-  own Mini Apps, while **Android stays windowed** — there fullscreen hides the native header and
-  its BackButton, and the Android system swipe-back then minimises the app instead of navigating —
-  and desktop keeps the bot's full-size window; move drafts auto-save, so there is **no
-  closing-confirmation guard**; **vertical swipes** (swipe-to-minimise)
-  are disabled so they don't fight tile drag or the board scroll; **external links** (the word-check
+  app's **own back chevron** (Header) drives back-navigation on every platform — the native
+  Telegram BackButton is not used, as it does not render reliably in the windowed Mini App;
+  **HapticFeedback** fires on tile placement / commit / error; the app calls `expand()` for the
+  bot's full-size (max-height) window but **never `requestFullscreen`** — immersive fullscreen hid
+  the native header (and its BackButton) and the Android system swipe-back then minimised the app,
+  so it stays windowed with Telegram's thin native header (close) above the app's own header; move
+  drafts auto-save, so there is **no closing-confirmation guard**; a hidden **debug panel** (ten
+  quick taps on the header title) shows and shares a privacy-safe client diagnostic snapshot for
+  support; **vertical swipes** (swipe-to-minimise) are disabled so they don't fight tile drag or
+  the board scroll; **external links** (the word-check
   dictionary lookup, the rules link, operator-reply links) open through `Telegram.WebApp.openLink`
   so Telegram shows them in its in-app browser instead of the WebView's "open this link?"
   confirmation a plain `target=_blank` triggers; and a live stream dropped