Stage 11: account linking & merge (email + Telegram Login Widget)

Link an email (confirm-code) or Telegram (web Login Widget) to the current
account; if the identity already has its own account, merge the two into the
one in use (the current account is primary, except a guest initiator whose
durable counterpart wins). The merge runs in one transaction
(internal/accountmerge): stats + hint wallet summed, paid_account ORed,
identities/games/chat/complaints transferred, friends/blocks de-duplicated,
the secondary kept as a merged_into tombstone so a shared finished game's
no-cascade FKs hold; a shared active game blocks the merge.

- migration 00009: accounts.paid_account, merged_into, merged_at (+ jetgen)
- internal/link orchestrator; session.RevokeAllForAccount on merge
- connector ValidateLoginWidget RPC + loginwidget HMAC validator
- edge ops link.email.request/confirm/merge, link.telegram.confirm/merge;
  supersedes the Stage 8 email.bind.* surface (request never reveals 'taken'
  before the code is verified, so a probe cannot enumerate addresses)
- UI Profile link section + irreversible-merge dialog; Telegram web sign-in
- focused regression tests (merge core, guest inversion, active-game refusal,
  finished-shared-game kept), gateway transcode + connector + UI codec/e2e
- docs: PLAN, ARCHITECTURE 3/4/9, FUNCTIONAL(+ru), module READMEs

ui/e2e/social.spec.ts

@@ -139,6 +139,34 @@ test('profile edit disables Save and flags an invalid display name', async ({ pa
   await expect(save).toBeEnabled();
 });
 
+test('link account: a taken email opens the irreversible merge confirmation', async ({ page }) => {
+  await loginLobby(page);
+  await page.locator('.burger').first().click();
+  await page.getByRole('button', { name: /Profile/ }).click();
+
+  // The linking section is shown to everyone (guests upgrade by linking).
+  await expect(page.getByRole('heading', { name: 'Link an account' })).toBeVisible();
+  // An address containing "merge" stands in (in the mock) for one already owned by
+  // another account, so the confirm step reveals a required merge.
+  await page.locator('.emailbox input[type="email"]').fill('merge@example.com');
+  await page.getByRole('button', { name: 'Send code' }).click();
+  await page.locator('.emailbox .codein').fill('123456');
+  await page.getByRole('button', { name: 'OK' }).click();
+
+  // The reveal happens only after the code, and names the other account.
+  await expect(page.getByText('Merge accounts?')).toBeVisible();
+  await expect(page.getByText(/Ann/)).toBeVisible();
+  await page.getByRole('button', { name: 'Merge' }).click();
+  await expect(page.getByText('Merge accounts?')).toBeHidden();
+});
+
+test('link account: the Telegram web sign-in control is offered in a browser', async ({ page }) => {
+  await loginLobby(page);
+  await page.locator('.burger').first().click();
+  await page.getByRole('button', { name: /Profile/ }).click();
+  await expect(page.getByRole('button', { name: 'Link Telegram' })).toBeVisible();
+});
+
 test('chat send and nudge are icon buttons', async ({ page }) => {
   await loginLobby(page);
   await page.getByRole('button', { name: /Ann/ }).click();