Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

backend/internal/account/account.go

@@ -63,8 +63,16 @@ type Account struct {
 	// true (the default): the platform side-service skips out-of-app push for the
 	// account (Stage 9).
 	NotificationsInAppOnly bool
-	CreatedAt              time.Time
-	UpdatedAt              time.Time
+	// PaidAccount marks a lifetime one-time-payment account. It is a service field
+	// (no purchase flow yet); an account linking & merge ORs it so a paid status is
+	// never lost when accounts are consolidated (Stage 11).
+	PaidAccount bool
+	// MergedInto is the primary account a retired (merged) secondary points at, or
+	// uuid.Nil for a live account. A tombstone keeps the row so the no-cascade
+	// foreign keys of a shared finished game stay valid (Stage 11).
+	MergedInto uuid.UUID
+	CreatedAt  time.Time
+	UpdatedAt  time.Time
 }
 
 // Identity is one of an account's platform/email identities, surfaced on the
@@ -368,6 +376,10 @@ func (s *Store) SpendHint(ctx context.Context, id uuid.UUID) (bool, error) {
 
 // modelToAccount projects a generated model row into the public Account struct.
 func modelToAccount(row model.Accounts) Account {
+	var mergedInto uuid.UUID
+	if row.MergedInto != nil {
+		mergedInto = *row.MergedInto
+	}
 	return Account{
 		ID:                     row.AccountID,
 		DisplayName:            row.DisplayName,
@@ -380,6 +392,8 @@ func modelToAccount(row model.Accounts) Account {
 		BlockFriendRequests:    row.BlockFriendRequests,
 		IsGuest:                row.IsGuest,
 		NotificationsInAppOnly: row.NotificationsInAppOnly,
+		PaidAccount:            row.PaidAccount,
+		MergedInto:             mergedInto,
 		CreatedAt:              row.CreatedAt,
 		UpdatedAt:              row.UpdatedAt,
 	}