feat(payments): VK Votes payment rail

Wire the VK Mini Apps ("голоса") rail end to end, reusing the intake engine. The
wallet.order endpoint branches by rail: a VK context opens a pending order
(provider vk) and returns its id, which the client passes to VKWebAppShowOrderBox.
VK's two-phase payment callback is verified at the gateway with the app protected
key (GATEWAY_VK_APP_SECRET) and proxied to a backend intake handler: get_item
returns the ordered pack's title and vote price; a chargeable order_status_change
credits the vk segment exactly once (the same Fund, idempotent on VK's own order
id) and records a succeeded event, so the dispatcher push refreshes the wallet.
Integration test for the VK order->credit path.

gateway/internal/connectsrv/server.go

@@ -31,6 +31,7 @@ import (
 	"scrabble/gateway/internal/ratelimit"
 	"scrabble/gateway/internal/session"
 	"scrabble/gateway/internal/transcode"
+	"scrabble/gateway/internal/vkpay"
 	"scrabble/gateway/internal/webui"
 	edgev1 "scrabble/gateway/proto/edge/v1"
 	"scrabble/gateway/proto/edge/v1/edgev1connect"
@@ -70,18 +71,19 @@ const (
 
 // Server implements edgev1connect.GatewayHandler.
 type Server struct {
-	registry   *transcode.Registry
-	sessions   *session.Cache
-	backend    *backendclient.Client
-	limiter    *ratelimit.Limiter
-	tracker    *ratelimit.Tracker
-	banlist    *ratelimit.Banlist
-	honeytoken string
-	hub        *push.Hub
-	heartbeat  time.Duration
-	log        *zap.Logger
-	adminProxy http.Handler
-	metrics    *serverMetrics
+	registry    *transcode.Registry
+	sessions    *session.Cache
+	backend     *backendclient.Client
+	limiter     *ratelimit.Limiter
+	tracker     *ratelimit.Tracker
+	banlist     *ratelimit.Banlist
+	honeytoken  string
+	vkAppSecret string
+	hub         *push.Hub
+	heartbeat   time.Duration
+	log         *zap.Logger
+	adminProxy  http.Handler
+	metrics     *serverMetrics
 
 	maxBodyBytes int
 
@@ -110,12 +112,15 @@ type Deps struct {
 	// Honeytoken, when non-empty, is the planted bearer value whose presentation
 	// bans the caller and raises a high-severity alarm.
 	Honeytoken string
-	Hub        *push.Hub
-	RateLimit  config.RateLimitConfig
-	Heartbeat  time.Duration
-	Logger     *zap.Logger
-	AdminProxy http.Handler
-	Meter      metric.Meter
+	// VKAppSecret is the VK Mini App protected key; it verifies the VK payment callback signature
+	// (the same key the launch-signature auth uses). Empty leaves the VK callback rejecting.
+	VKAppSecret string
+	Hub         *push.Hub
+	RateLimit   config.RateLimitConfig
+	Heartbeat   time.Duration
+	Logger      *zap.Logger
+	AdminProxy  http.Handler
+	Meter       metric.Meter
 	// MaxBodyBytes caps one inbound request body and one Connect message read;
 	// zero or negative selects config.DefaultMaxBodyBytes.
 	MaxBodyBytes int
@@ -151,6 +156,7 @@ func NewServer(d Deps) *Server {
 		registry:     d.Registry,
 		sessions:     d.Sessions,
 		backend:      d.Backend,
+		vkAppSecret:  d.VKAppSecret,
 		limiter:      limiter,
 		tracker:      tracker,
 		banlist:      banlist,
@@ -199,6 +205,7 @@ func (s *Server) HTTPHandler() http.Handler {
 	// Direct-rail (Robokassa) return + callback routes: the server Result callback (the single
 	// crediting signal, proxied to the backend intake) and the browser Success/Fail redirects.
 	mux.Handle("/pay/robokassa/result", s.robokassaResultHandler())
+	mux.Handle("/pay/vk/callback", s.vkCallbackHandler())
 	mux.Handle("/pay/robokassa/success", s.robokassaReturnHandler("Оплата принята."))
 	mux.Handle("/pay/robokassa/fail", s.robokassaReturnHandler("Оплата не завершена."))
 	// The client posts its local-move-preview adoption telemetry here (session-gated).
@@ -522,6 +529,46 @@ func (s *Server) robokassaResultHandler() http.Handler {
 	})
 }
 
+// vkCallbackHandler proxies a VK Mini Apps payment callback to the backend intake. It rate-limits
+// per IP, verifies the VK signature with the app's protected key (the backend holds no VK secret),
+// forwards the provider's parameters, and relays the backend's VK response envelope. A missing or
+// bad signature is rejected before reaching the backend.
+func (s *Server) vkCallbackHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.backend == nil {
+			http.NotFound(w, r)
+			return
+		}
+		ip := peerIP(r.RemoteAddr, r.Header)
+		if !s.limiter.Allow("public:"+ip, s.publicPolicy) {
+			s.noteRateLimited(r.Context(), classPublic, ip, "vk-callback")
+			http.Error(w, "rate limited", http.StatusTooManyRequests)
+			return
+		}
+		if err := r.ParseForm(); err != nil {
+			http.Error(w, "bad request", http.StatusBadRequest)
+			return
+		}
+		params := make(map[string]string, len(r.Form))
+		for k := range r.Form {
+			params[k] = r.Form.Get(k)
+		}
+		if !vkpay.Verify(params, s.vkAppSecret) {
+			s.log.Warn("vk callback: bad signature")
+			http.Error(w, "bad signature", http.StatusForbidden)
+			return
+		}
+		resp, err := s.backend.VKCallback(r.Context(), params)
+		if err != nil {
+			s.log.Warn("vk callback proxy failed", zap.Error(err))
+			http.Error(w, "bad gateway", http.StatusBadGateway)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		_, _ = w.Write(resp)
+	})
+}
+
 // robokassaReturnHandler serves a minimal self-closing page for Robokassa's Success/Fail browser
 // return. The payment opens in a separate window, so on return this closes that window and drops the
 // customer back into the live app (never a cold app start); a link is the fallback if the window