Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

gateway/internal/transcode/transcode.go

@@ -63,10 +63,13 @@ type Registry struct {
 	ops map[string]Op
 }
 
-// TelegramValidator validates Mini App launch data via the connector side-service.
-// *connector.Client implements it; a nil value disables the telegram auth path.
+// TelegramValidator validates Telegram credentials via the connector side-service:
+// Mini App launch data (auth) and Login Widget data (linking, Stage 11).
+// *connector.Client implements it; a nil value disables the telegram auth and
+// telegram-link paths.
 type TelegramValidator interface {
 	ValidateInitData(ctx context.Context, initData string) (connector.User, error)
+	ValidateLoginWidget(ctx context.Context, data string) (connector.User, error)
 }
 
 // NewRegistry builds the slice's message-type catalog over the backend client.
@@ -98,6 +101,7 @@ func NewRegistry(backend *backendclient.Client, tg TelegramValidator) *Registry
 	r.ops[MsgChatList] = Op{Handler: chatListHandler(backend), Auth: true}
 	r.ops[MsgChatNudge] = Op{Handler: nudgeHandler(backend), Auth: true}
 	registerStage8(r, backend)
+	registerStage11(r, backend, tg)
 	return r
 }
 
@@ -118,6 +122,9 @@ func DomainCode(err error) (string, bool) {
 	if errors.Is(err, connector.ErrInvalidInitData) {
 		return "invalid_init_data", true
 	}
+	if errors.Is(err, connector.ErrInvalidLoginWidget) {
+		return "invalid_login_widget", true
+	}
 	return "", false
 }