feat(ui): drop Telegram fullscreen; own back chevron everywhere; hidden debug panel

Finalises the Telegram Mini App navigation work after on-device testing (Pixel
10 / Android 17 + iOS, fresh beta clients):

- Remove requestFullscreen entirely. Immersive fullscreen hid Telegram's native
  header (and its BackButton) and the Android system swipe-back minimised the
  app; the owner prefers the windowed full-size (expand) presentation, so the
  app never requests fullscreen on any platform now.
- The app's own back chevron (Header, showBack = !!back) drives back-navigation
  on every platform; the native Telegram BackButton is dropped — it does not
  render in the windowed Mini App (backVisible=false on iOS and Android), so
  relying on it lost back navigation (notably none on iOS).
- Replace the temporary always-on diagnostic overlay with a hidden debug panel
  (components/DebugPanel): ten quick taps on the header title open it; it shows a
  privacy-safe client diagnostic snapshot (app version, locale, online, userId,
  Telegram chrome / viewport / SDK state — no secrets, no IP) and shares it via
  the OS share sheet / clipboard; a tap anywhere except Share dismisses it.
- Drop the now-dead telegramRequestFullscreen / telegramBackButton /
  isTelegramAndroid helpers and the iOS-fullscreen unit test.

Telegram has no native non-modal notification API (only modal showPopup /
showAlert), so in-app toasts stay ours. Docs: UI_DESIGN.md.

ui/src/lib/app.svelte.ts

@@ -25,7 +25,6 @@ import {
   telegramLaunch,
   type TelegramLaunch,
   telegramOnEvent,
-  telegramRequestFullscreen,
   telegramSetChrome,
 } from './telegram';
 import { parseStartParam } from './deeplink';
@@ -56,6 +55,9 @@ export const app = $state<{
    *  launch-error screen (screens/TelegramLaunchError) — a shareable probe for why Telegram
    *  delivered no initData (seen on some Android clients) — instead of bouncing to the landing. */
   launchError: TelegramDiag | null;
+  /** Whether the hidden on-device debug panel (components/DebugPanel) is open — toggled by tapping
+   *  the header title ten times in quick succession. A support aid; carries no secrets. */
+  debugOpen: boolean;
   /** Whether the lobby's first cold load has settled (success or error). The loading splash
    *  (components/Splash.svelte) watches it to know when to dismiss; set by screens/Lobby. */
   lobbyReady: boolean;
@@ -106,6 +108,7 @@ export const app = $state<{
   ready: false,
   bootError: false,
   launchError: null,
+  debugOpen: false,
   lobbyReady: false,
   splashDone: false,
   streamAlive: false,
@@ -197,6 +200,16 @@ export function dismissWelcomeRedeem(): void {
   app.welcomeRedeem = false;
 }
 
+/** openDebug / closeDebug toggle the hidden on-device debug panel (components/DebugPanel), opened
+ *  by tapping the header title ten times — a support aid that shows and shares client diagnostics. */
+export function openDebug(): void {
+  app.debugOpen = true;
+}
+
+export function closeDebug(): void {
+  app.debugOpen = false;
+}
+
 /**
  * seedChatUnread sets a game's unread flags from an authoritative per-viewer REST view (the lobby
  * list, a game's state, or a move result): unread is any unread entry, message whether one of them
@@ -557,10 +570,6 @@ function applyTelegramChrome(launch: TelegramLaunch): void {
   syncTelegramChrome();
   syncTelegramSafeArea();
   telegramDisableVerticalSwipes();
-  // On mobile, go immersive fullscreen like Telegram's own Mini Apps; the fullscreenChanged
-  // listener (registered at bootstrap) then re-syncs the safe-area insets. Desktop keeps the bot's
-  // full-size window. No-op on clients predating Bot API 8.0.
-  telegramRequestFullscreen();
 }
 
 /** How long to wait for the dynamically loaded Telegram Mini App SDK before giving up and showing