Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

gateway/internal/backendclient/api.go

@@ -109,11 +109,35 @@ type ChatResp struct {
 	CreatedAtUnix int64  `json:"created_at_unix"`
 }
 
-// TelegramAuth provisions/finds the Telegram account and mints a session.
-func (c *Client) TelegramAuth(ctx context.Context, externalID string) (SessionResp, error) {
+// TelegramAuth provisions/finds the Telegram account and mints a session, seeding a
+// brand-new account's display name and language from the validated launch fields.
+func (c *Client) TelegramAuth(ctx context.Context, externalID, languageCode, username, firstName string) (SessionResp, error) {
 	var out SessionResp
 	err := c.do(ctx, http.MethodPost, "/api/v1/internal/sessions/telegram", "", "",
-		map[string]string{"external_id": externalID}, &out)
+		map[string]string{
+			"external_id":   externalID,
+			"language_code": languageCode,
+			"username":      username,
+			"first_name":    firstName,
+		}, &out)
+	return out, err
+}
+
+// PushTargetResp is a recipient's out-of-app push routing data: their Telegram
+// external_id (empty when they have no Telegram identity), preferred language, and
+// whether they confined notifications to the in-app stream.
+type PushTargetResp struct {
+	ExternalID             string `json:"external_id"`
+	Language               string `json:"language"`
+	NotificationsInAppOnly bool   `json:"notifications_in_app_only"`
+}
+
+// PushTarget resolves a user id to their out-of-app Telegram routing data (the
+// gateway uses it to decide whether to deliver an event over platform push).
+func (c *Client) PushTarget(ctx context.Context, userID string) (PushTargetResp, error) {
+	var out PushTargetResp
+	err := c.do(ctx, http.MethodPost, "/api/v1/internal/push-target", "", "",
+		map[string]string{"user_id": userID}, &out)
 	return out, err
 }