Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

pkg/proto/telegram/v1/telegram_grpc.pb.go

@@ -30,10 +30,11 @@ import (
 const _ = grpc.SupportPackageIsVersion9
 
 const (
-	Telegram_ValidateInitData_FullMethodName  = "/scrabble.telegram.v1.Telegram/ValidateInitData"
-	Telegram_Notify_FullMethodName            = "/scrabble.telegram.v1.Telegram/Notify"
-	Telegram_SendToUser_FullMethodName        = "/scrabble.telegram.v1.Telegram/SendToUser"
-	Telegram_SendToGameChannel_FullMethodName = "/scrabble.telegram.v1.Telegram/SendToGameChannel"
+	Telegram_ValidateInitData_FullMethodName    = "/scrabble.telegram.v1.Telegram/ValidateInitData"
+	Telegram_ValidateLoginWidget_FullMethodName = "/scrabble.telegram.v1.Telegram/ValidateLoginWidget"
+	Telegram_Notify_FullMethodName              = "/scrabble.telegram.v1.Telegram/Notify"
+	Telegram_SendToUser_FullMethodName          = "/scrabble.telegram.v1.Telegram/SendToUser"
+	Telegram_SendToGameChannel_FullMethodName   = "/scrabble.telegram.v1.Telegram/SendToGameChannel"
 )
 
 // TelegramClient is the client API for Telegram service.
@@ -46,6 +47,11 @@ type TelegramClient interface {
 	// the authenticated user. The gateway calls it during the auth.telegram edge
 	// operation, then provisions the session through the backend internal API.
 	ValidateInitData(ctx context.Context, in *ValidateInitDataRequest, opts ...grpc.CallOption) (*ValidateInitDataResponse, error)
+	// ValidateLoginWidget verifies Telegram Login Widget authorization data (the web
+	// sign-in flow, HMAC under SHA-256(bot_token)) and returns the authenticated
+	// user. The gateway calls it during the link.telegram edge operation to attach a
+	// Telegram identity to an existing account (Stage 11).
+	ValidateLoginWidget(ctx context.Context, in *ValidateLoginWidgetRequest, opts ...grpc.CallOption) (*ValidateLoginWidgetResponse, error)
 	// Notify delivers an out-of-app notification for a backend push event. The
 	// gateway calls it only for a recipient with no live in-app stream (so the
 	// platform push never duplicates in-app delivery). The connector renders a
@@ -79,6 +85,16 @@ func (c *telegramClient) ValidateInitData(ctx context.Context, in *ValidateInitD
 	return out, nil
 }
 
+func (c *telegramClient) ValidateLoginWidget(ctx context.Context, in *ValidateLoginWidgetRequest, opts ...grpc.CallOption) (*ValidateLoginWidgetResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ValidateLoginWidgetResponse)
+	err := c.cc.Invoke(ctx, Telegram_ValidateLoginWidget_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *telegramClient) Notify(ctx context.Context, in *NotifyRequest, opts ...grpc.CallOption) (*NotifyResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(NotifyResponse)
@@ -119,6 +135,11 @@ type TelegramServer interface {
 	// the authenticated user. The gateway calls it during the auth.telegram edge
 	// operation, then provisions the session through the backend internal API.
 	ValidateInitData(context.Context, *ValidateInitDataRequest) (*ValidateInitDataResponse, error)
+	// ValidateLoginWidget verifies Telegram Login Widget authorization data (the web
+	// sign-in flow, HMAC under SHA-256(bot_token)) and returns the authenticated
+	// user. The gateway calls it during the link.telegram edge operation to attach a
+	// Telegram identity to an existing account (Stage 11).
+	ValidateLoginWidget(context.Context, *ValidateLoginWidgetRequest) (*ValidateLoginWidgetResponse, error)
 	// Notify delivers an out-of-app notification for a backend push event. The
 	// gateway calls it only for a recipient with no live in-app stream (so the
 	// platform push never duplicates in-app delivery). The connector renders a
@@ -145,6 +166,9 @@ type UnimplementedTelegramServer struct{}
 func (UnimplementedTelegramServer) ValidateInitData(context.Context, *ValidateInitDataRequest) (*ValidateInitDataResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ValidateInitData not implemented")
 }
+func (UnimplementedTelegramServer) ValidateLoginWidget(context.Context, *ValidateLoginWidgetRequest) (*ValidateLoginWidgetResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ValidateLoginWidget not implemented")
+}
 func (UnimplementedTelegramServer) Notify(context.Context, *NotifyRequest) (*NotifyResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Notify not implemented")
 }
@@ -193,6 +217,24 @@ func _Telegram_ValidateInitData_Handler(srv interface{}, ctx context.Context, de
 	return interceptor(ctx, in, info, handler)
 }
 
+func _Telegram_ValidateLoginWidget_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ValidateLoginWidgetRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TelegramServer).ValidateLoginWidget(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Telegram_ValidateLoginWidget_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TelegramServer).ValidateLoginWidget(ctx, req.(*ValidateLoginWidgetRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _Telegram_Notify_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(NotifyRequest)
 	if err := dec(in); err != nil {
@@ -258,6 +300,10 @@ var Telegram_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ValidateInitData",
 			Handler:    _Telegram_ValidateInitData_Handler,
 		},
+		{
+			MethodName: "ValidateLoginWidget",
+			Handler:    _Telegram_ValidateLoginWidget_Handler,
+		},
 		{
 			MethodName: "Notify",
 			Handler:    _Telegram_Notify_Handler,