Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

docs/FUNCTIONAL.md

@@ -36,11 +36,17 @@ out-of-app events (your turn, nudge, a found match, an invitation or friend requ
 arrive as a **Telegram notification** instead — unless the player keeps notifications
 in the app only (a profile setting, **on by default**).
 
-### Accounts, linking & merge *(Stage 1 / 10)*
-First platform contact auto-provisions a durable account. From the profile a
-player links additional platform identities or an email via a confirm flow;
-linking an identity that already has history merges it into the current
-account (stats summed, games/friends transferred).
+### Accounts, linking & merge *(Stage 1 / 11)*
+First platform contact auto-provisions a durable account. From the profile a player
+links an email (via a confirm code) or their Telegram (via the web sign-in); a guest
+who links their first identity becomes a durable account. The "already taken" status
+of an identity is never revealed before the code/sign-in is verified. If the linked
+identity already belongs to another account, the player is shown an explicit,
+**irreversible** confirmation and the two accounts are merged into the one they are
+using (statistics summed, games and friends transferred, duplicates removed) — except
+when a guest links an identity that already has a durable account, where the durable
+account is kept and the guest's games move into it. A merge is blocked only while the
+two accounts share a game still in progress.
 
 ### Lobby & matchmaking *(Stage 4)*
 Bottom tab menu: **my games**, **profile**. Auto-match (always 2 players) joins a
@@ -95,11 +101,9 @@ nudge is part of the game chat); the out-of-app push is delivered via the platfo
 ### Profile & settings *(Stage 4 / 8)*
 Edit the display name (letters joined by single space / "." / "_" separators, up to
 32 characters), the timezone (chosen as a UTC offset), the daily away window (on a
-10-minute grid, at most 12 hours, wrapping midnight) and the block toggles, and bind
-an email by confirm-code: the backend emails a short code that,
-once entered, attaches the email to the account (an email already confirmed by
-another account cannot be taken — that is a merge, a later stage). Linked platform
-accounts and merge arrive in Stage 11.
+10-minute grid, at most 12 hours, wrapping midnight) and the block toggles. Linking
+an email or Telegram and merging accounts are covered under "Accounts, linking &
+merge" (Stage 11).
 
 ### History & statistics *(Stage 3 / 8)*
 Finished games are archived in a dictionary-independent form and exportable to