Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

backend/internal/postgres/jet/backend/model/accounts.go

@@ -26,4 +26,7 @@ type Accounts struct {
 	HintBalance            int32
 	IsGuest                bool
 	NotificationsInAppOnly bool
+	PaidAccount            bool
+	MergedInto             *uuid.UUID
+	MergedAt               *time.Time
 }

backend/internal/postgres/jet/backend/table/accounts.go

@@ -30,6 +30,9 @@ type accountsTable struct {
 	HintBalance            postgres.ColumnInteger
 	IsGuest                postgres.ColumnBool
 	NotificationsInAppOnly postgres.ColumnBool
+	PaidAccount            postgres.ColumnBool
+	MergedInto             postgres.ColumnString
+	MergedAt               postgres.ColumnTimestampz
 
 	AllColumns     postgres.ColumnList
 	MutableColumns postgres.ColumnList
@@ -84,9 +87,12 @@ func newAccountsTableImpl(schemaName, tableName, alias string) accountsTable {
 		HintBalanceColumn            = postgres.IntegerColumn("hint_balance")
 		IsGuestColumn                = postgres.BoolColumn("is_guest")
 		NotificationsInAppOnlyColumn = postgres.BoolColumn("notifications_in_app_only")
-		allColumns                   = postgres.ColumnList{AccountIDColumn, DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn}
-		mutableColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn}
-		defaultColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn}
+		PaidAccountColumn            = postgres.BoolColumn("paid_account")
+		MergedIntoColumn             = postgres.StringColumn("merged_into")
+		MergedAtColumn               = postgres.TimestampzColumn("merged_at")
+		allColumns                   = postgres.ColumnList{AccountIDColumn, DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn}
+		mutableColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn, MergedIntoColumn, MergedAtColumn}
+		defaultColumns               = postgres.ColumnList{DisplayNameColumn, PreferredLanguageColumn, TimeZoneColumn, BlockChatColumn, BlockFriendRequestsColumn, CreatedAtColumn, UpdatedAtColumn, AwayStartColumn, AwayEndColumn, HintBalanceColumn, IsGuestColumn, NotificationsInAppOnlyColumn, PaidAccountColumn}
 	)
 
 	return accountsTable{
@@ -106,6 +112,9 @@ func newAccountsTableImpl(schemaName, tableName, alias string) accountsTable {
 		HintBalance:            HintBalanceColumn,
 		IsGuest:                IsGuestColumn,
 		NotificationsInAppOnly: NotificationsInAppOnlyColumn,
+		PaidAccount:            PaidAccountColumn,
+		MergedInto:             MergedIntoColumn,
+		MergedAt:               MergedAtColumn,
 
 		AllColumns:     allColumns,
 		MutableColumns: mutableColumns,

backend/internal/postgres/migrations/00009_account_merge.sql

@@ -0,0 +1,24 @@
+-- +goose Up
+-- Stage 11 account linking & merge: retire a secondary account into a primary one.
+-- merged_into/merged_at turn the secondary into an audit tombstone (its identities
+-- are repointed and its non-shared rows transferred to the primary, but the row is
+-- kept so the no-cascade game_players/chat/complaints foreign keys of any shared
+-- finished game stay valid). merged_into self-references accounts and is SET NULL on
+-- delete so a future guest reaper (PLAN.md TODO-3) can still remove a primary.
+-- paid_account is a forward-looking lifetime one-time-payment marker (no purchase
+-- flow yet); the merge ORs it so a paid status is never lost. Adds columns, so the
+-- generated jet code is regenerated (cmd/jetgen).
+SET search_path = backend, pg_catalog;
+
+ALTER TABLE accounts
+    ADD COLUMN paid_account boolean     NOT NULL DEFAULT false,
+    ADD COLUMN merged_into  uuid        REFERENCES accounts (account_id) ON DELETE SET NULL,
+    ADD COLUMN merged_at    timestamptz;
+
+-- +goose Down
+SET search_path = backend, pg_catalog;
+
+ALTER TABLE accounts
+    DROP COLUMN merged_at,
+    DROP COLUMN merged_into,
+    DROP COLUMN paid_account;