Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

gateway/README.md

@@ -51,8 +51,12 @@ The Stage 6 message-type slice: `auth.telegram`, `auth.guest`,
 added the play-loop ops; **Stage 8** added the social/account/history ops —
 `friends.*` (list/incoming/request/respond/cancel/unfriend/code.issue/code.redeem),
 `blocks.*`, `invitation.*` (list/create/accept/decline/cancel), `profile.update`,
-`email.bind.*`, `stats.get`, `game.gcg`, and the `notify` live event — all via the
-identical transcode pattern (`transcode_social.go`).
+`stats.get`, `game.gcg`, and the `notify` live event — all via the identical
+transcode pattern (`transcode_social.go`). **Stage 11** added account linking & merge
+— `link.email.request/confirm/merge` and `link.telegram.confirm/merge`
+(`transcode_link.go`); the telegram ops validate the **Login Widget** payload via the
+connector (`ValidateLoginWidget`) and forward the trusted `external_id`. These
+**superseded** the Stage 8 `email.bind.*` ops, which were removed.
 
 ## Configuration