Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

backend/internal/server/handlers.go

@@ -10,6 +10,7 @@ import (
 	"go.uber.org/zap"
 
 	"scrabble/backend/internal/account"
+	"scrabble/backend/internal/accountmerge"
 	"scrabble/backend/internal/engine"
 	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/lobby"
@@ -42,9 +43,15 @@ func (s *Server) registerRoutes() {
 		u.PUT("/profile", s.handleUpdateProfile)
 		u.GET("/stats", s.handleStats)
 	}
-	if s.emails != nil {
-		u.POST("/email/request", s.handleEmailBindRequest)
-		u.POST("/email/confirm", s.handleEmailBindConfirm)
+	if s.links != nil {
+		// Account linking & merge (Stage 11). The request step always mails a code;
+		// a required merge is revealed only after the code is verified, and the
+		// irreversible merge is an explicit second step.
+		u.POST("/link/email/request", s.handleLinkEmailRequest)
+		u.POST("/link/email/confirm", s.handleLinkEmailConfirm)
+		u.POST("/link/email/merge", s.handleLinkEmailMerge)
+		u.POST("/link/telegram", s.handleLinkTelegram)
+		u.POST("/link/telegram/merge", s.handleLinkTelegramMerge)
 	}
 	if s.games != nil {
 		u.GET("/games", s.handleListGames)
@@ -179,8 +186,10 @@ func statusForError(err error) (int, string) {
 		return http.StatusConflict, "hint_unavailable"
 	case errors.Is(err, engine.ErrIllegalPlay), errors.Is(err, engine.ErrTilesNotOnRack), errors.Is(err, engine.ErrGameOver):
 		return http.StatusUnprocessableEntity, "illegal_play"
-	case errors.Is(err, account.ErrEmailTaken):
+	case errors.Is(err, account.ErrEmailTaken), errors.Is(err, account.ErrIdentityTaken):
 		return http.StatusConflict, "email_taken"
+	case errors.Is(err, accountmerge.ErrActiveGameConflict):
+		return http.StatusConflict, "merge_active_game_conflict"
 	case errors.Is(err, account.ErrInvalidEmail):
 		return http.StatusBadRequest, "invalid_email"
 	case errors.Is(err, account.ErrCodeMismatch), errors.Is(err, account.ErrCodeExpired),