Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

pkg/proto/telegram/v1/telegram.proto

@@ -20,6 +20,11 @@ service Telegram {
   // the authenticated user. The gateway calls it during the auth.telegram edge
   // operation, then provisions the session through the backend internal API.
   rpc ValidateInitData(ValidateInitDataRequest) returns (ValidateInitDataResponse);
+  // ValidateLoginWidget verifies Telegram Login Widget authorization data (the web
+  // sign-in flow, HMAC under SHA-256(bot_token)) and returns the authenticated
+  // user. The gateway calls it during the link.telegram edge operation to attach a
+  // Telegram identity to an existing account (Stage 11).
+  rpc ValidateLoginWidget(ValidateLoginWidgetRequest) returns (ValidateLoginWidgetResponse);
   // Notify delivers an out-of-app notification for a backend push event. The
   // gateway calls it only for a recipient with no live in-app stream (so the
   // platform push never duplicates in-app delivery). The connector renders a
@@ -50,6 +55,21 @@ message ValidateInitDataResponse {
   string language_code = 4;
 }
 
+// ValidateLoginWidgetRequest carries the Login Widget result serialized as a URL
+// query string (the widget fields plus the hash, e.g. "auth_date=...&id=...&hash=...").
+message ValidateLoginWidgetRequest {
+  string data = 1;
+}
+
+// ValidateLoginWidgetResponse is the validated identity. external_id is the
+// Telegram user id used as the identities external_id. The Login Widget carries no
+// language_code (unlike Mini App initData).
+message ValidateLoginWidgetResponse {
+  string external_id = 1;
+  string username = 2;
+  string first_name = 3;
+}
+
 // NotifyRequest addresses a push event to one recipient. kind is the backend push
 // catalog kind (your_turn, nudge, match_found, notify); payload is the FlatBuffers
 // scrabblefb.* body for that kind; language (en/ru) selects the message template.