feat(profile): carry linked identities in the profile (email, telegram, vk)

Add email / telegram_linked / vk_linked to the Profile (fbs table + regenerated
Go/TS bindings, gateway ProfileResp + encodeProfile, backend DTO, UI model +
decode). They are filled outside the pure projection — Server.profileResponse now
reads the account's identities (like the banner seam) — and will drive the profile's
Add / Unlink / change-email controls.

backend/internal/server/banner.go

@@ -45,9 +45,34 @@ type bannerTimingsDTO struct {
 func (s *Server) profileResponse(ctx context.Context, acc account.Account) profileResponse {
 	r := profileResponseFor(acc)
 	r.Banner = s.bannerFor(ctx, acc)
+	s.fillLinkedIdentities(ctx, &r, acc.ID)
 	return r
 }
 
+// fillLinkedIdentities sets the profile's confirmed email address and platform-linked
+// flags from the account's identities, so the client offers the right link / unlink /
+// change-email controls. A read failure leaves them zero (no controls), logged as a
+// warning so the profile response still succeeds.
+func (s *Server) fillLinkedIdentities(ctx context.Context, r *profileResponse, accountID uuid.UUID) {
+	ids, err := s.accounts.Identities(ctx, accountID)
+	if err != nil {
+		s.log.Warn("profile: identities read failed", zap.String("account", accountID.String()), zap.Error(err))
+		return
+	}
+	for _, id := range ids {
+		switch id.Kind {
+		case account.KindEmail:
+			if id.Confirmed {
+				r.Email = id.ExternalID
+			}
+		case account.KindTelegram:
+			r.TelegramLinked = true
+		case account.KindVK:
+			r.VkLinked = true
+		}
+	}
+}
+
 // bannerFor builds the advertising-banner block for the account's profile, or
 // nil when the ads service is not configured or the viewer is not eligible to
 // see a banner. The message language follows the account's bot (service)

backend/internal/server/dto.go

@@ -56,6 +56,13 @@ type profileResponse struct {
 	// see the banner (a free account with an empty hint wallet and without the
 	// no_banner role), absent otherwise. See banner.go.
 	Banner *bannerDTO `json:"banner,omitempty"`
+	// Email is the account's confirmed email address ("" when none); TelegramLinked and
+	// VkLinked report whether a platform identity is attached. They drive the profile's
+	// link / unlink / change-email controls, and are filled outside the pure projection
+	// (they read the account's identities). See Server.profileResponse.
+	Email          string `json:"email"`
+	TelegramLinked bool   `json:"telegram_linked"`
+	VkLinked       bool   `json:"vk_linked"`
 }
 
 // tileDTO is one placed (or to-place) tile.