Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

backend/internal/server/handlers_account.go

@@ -38,17 +38,6 @@ type statsDTO struct {
 	MaxWordPoints int `json:"max_word_points"`
 }
 
-// emailBindRequestBody starts binding an email to the caller's account.
-type emailBindRequestBody struct {
-	Email string `json:"email"`
-}
-
-// emailBindConfirmBody completes binding an email with its confirm code.
-type emailBindConfirmBody struct {
-	Email string `json:"email"`
-	Code  string `json:"code"`
-}
-
 // parseAwayTime parses an "HH:MM" away-window bound.
 func parseAwayTime(s string) (time.Time, bool) {
 	t, err := time.Parse(awayTimeLayout, strings.TrimSpace(s))
@@ -117,43 +106,3 @@ func (s *Server) handleStats(c *gin.Context) {
 		MaxWordPoints: st.MaxWordPoints,
 	})
 }
-
-// handleEmailBindRequest issues a confirm code to bind an email to the caller.
-func (s *Server) handleEmailBindRequest(c *gin.Context) {
-	uid, ok := userID(c)
-	if !ok {
-		abortBadRequest(c, "missing identity")
-		return
-	}
-	var req emailBindRequestBody
-	if err := c.ShouldBindJSON(&req); err != nil {
-		abortBadRequest(c, "invalid request body")
-		return
-	}
-	if err := s.emails.RequestCode(c.Request.Context(), uid, req.Email); err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	c.JSON(http.StatusOK, okResponse{OK: true})
-}
-
-// handleEmailBindConfirm verifies the code and binds the email, returning the
-// updated profile.
-func (s *Server) handleEmailBindConfirm(c *gin.Context) {
-	uid, ok := userID(c)
-	if !ok {
-		abortBadRequest(c, "missing identity")
-		return
-	}
-	var req emailBindConfirmBody
-	if err := c.ShouldBindJSON(&req); err != nil {
-		abortBadRequest(c, "invalid request body")
-		return
-	}
-	acc, err := s.emails.ConfirmCode(c.Request.Context(), uid, req.Email, req.Code)
-	if err != nil {
-		s.abortErr(c, err)
-		return
-	}
-	c.JSON(http.StatusOK, profileResponseFor(acc))
-}