Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

gateway/internal/connector/client.go

@@ -22,6 +22,10 @@ import (
 // result code.
 var ErrInvalidInitData = errors.New("connector: invalid telegram init data")
 
+// ErrInvalidLoginWidget is returned by ValidateLoginWidget when the connector
+// rejects the Login Widget data (a gRPC InvalidArgument).
+var ErrInvalidLoginWidget = errors.New("connector: invalid telegram login widget data")
+
 // User is a validated Mini App identity.
 type User struct {
 	ExternalID   string
@@ -66,6 +70,24 @@ func (c *Client) ValidateInitData(ctx context.Context, initData string) (User, e
 	}, nil
 }
 
+// ValidateLoginWidget verifies Telegram Login Widget data and returns the user
+// identity, mapping a connector InvalidArgument to ErrInvalidLoginWidget. It backs
+// the link.telegram edge operation (Stage 11).
+func (c *Client) ValidateLoginWidget(ctx context.Context, data string) (User, error) {
+	resp, err := c.c.ValidateLoginWidget(ctx, &telegramv1.ValidateLoginWidgetRequest{Data: data})
+	if err != nil {
+		if status.Code(err) == codes.InvalidArgument {
+			return User{}, ErrInvalidLoginWidget
+		}
+		return User{}, err
+	}
+	return User{
+		ExternalID: resp.GetExternalId(),
+		Username:   resp.GetUsername(),
+		FirstName:  resp.GetFirstName(),
+	}, nil
+}
+
 // Notify delivers an out-of-app notification for a push event; delivered reports
 // whether a message was actually sent.
 func (c *Client) Notify(ctx context.Context, externalID, kind string, payload []byte, language string) (bool, error) {