feat(telegram,game): single bot + per-user variant preferences

Collapse the two per-language Telegram bots into one unified bot and
replace language-based variant gating with explicit per-user variant
preferences.

- Telegram: one bot; drop service_language and the supported_languages
  set everywhere (DB, account, auth, FlatBuffers Session wire, gateway,
  connector proto). The single bot renders chat and out-of-app push in
  the recipient's preferred_language; remove the game-language push
  routing override (notify Intent.Language / push Event.language).
- Preferences: new accounts.variant_preferences (text[], DB default
  {erudit_ru}, CHECK non-empty + subset of the three variants). Gates
  the New Game picker, vs-AI and the friend invitation the player
  creates, enforced server-side (HTTP 400 otherwise); an invited friend
  may still accept any variant. Edited on the Settings screen; variants
  are Erudit-first everywhere.
- Admin: drop the per-bot language selectors (broadcast / send-to-user)
  and the feedback channel_lang column/field.
- Env/CI: collapse TELEGRAM_BOT_TOKEN_{EN,RU}, TELEGRAM_GAME_CHANNEL_ID_{EN,RU},
  VITE_TELEGRAM_LINK{,_EN,_RU} and VITE_TELEGRAM_GAME_CHANNEL_NAME_{EN,RU}
  to single unsuffixed names; drop GATEWAY_DEFAULT_SUPPORTED_LANGUAGES.
- Docs updated (ARCHITECTURE, FUNCTIONAL + _ru, platform/telegram, gateway,
  backend, ui, UI_DESIGN, PRERELEASE).

The migration squash is deferred to a follow-up PR.

backend/internal/inttest/account_test.go

@@ -159,46 +159,6 @@ func TestProvisionTelegramUnknownLanguageDefaults(t *testing.T) {
 	}
 }
 
-// TestServiceLanguageRoundTrip checks SetServiceLanguage persists the push-routing
-// language (the bot a Telegram user last signed in through): a fresh account has
-// none, a set value reads back, a later login overwrites it (last-login-wins), and
-// an empty value is a no-op. The push-target route coalesces it with the preferred
-// language.
-func TestServiceLanguageRoundTrip(t *testing.T) {
-	ctx := context.Background()
-	store := account.NewStore(testDB)
-	acc, err := store.ProvisionTelegram(ctx, "tg-"+uuid.NewString(), "en", "", "Player")
-	if err != nil {
-		t.Fatalf("provision telegram: %v", err)
-	}
-	if acc.ServiceLanguage != "" {
-		t.Errorf("fresh ServiceLanguage = %q, want empty", acc.ServiceLanguage)
-	}
-
-	if err := store.SetServiceLanguage(ctx, acc.ID, "ru"); err != nil {
-		t.Fatalf("set service language: %v", err)
-	}
-	if got, err := store.GetByID(ctx, acc.ID); err != nil {
-		t.Fatalf("get by id: %v", err)
-	} else if got.ServiceLanguage != "ru" {
-		t.Errorf("ServiceLanguage = %q, want ru", got.ServiceLanguage)
-	}
-
-	// A later login through the other bot updates it; a subsequent empty value
-	// (a non-Telegram login) leaves it unchanged.
-	if err := store.SetServiceLanguage(ctx, acc.ID, "en"); err != nil {
-		t.Fatalf("update service language: %v", err)
-	}
-	if err := store.SetServiceLanguage(ctx, acc.ID, ""); err != nil {
-		t.Fatalf("noop service language: %v", err)
-	}
-	if got, err := store.GetByID(ctx, acc.ID); err != nil {
-		t.Fatalf("get by id: %v", err)
-	} else if got.ServiceLanguage != "en" {
-		t.Errorf("ServiceLanguage after update+noop = %q, want en", got.ServiceLanguage)
-	}
-}
-
 // TestHighRateFlagRoundTrip covers the soft high-rate marker: a fresh account
 // is unflagged, FlagHighRate stamps it exactly once (a second sustained episode
 // never moves the timestamp), ClearHighRateFlag reverses it, and a re-flag after
@@ -299,6 +259,7 @@ func TestNotificationsInAppOnlyRoundTrip(t *testing.T) {
 		PreferredLanguage:      "en",
 		TimeZone:               "UTC",
 		NotificationsInAppOnly: false,
+		VariantPreferences:     []string{"erudit_ru"},
 	})
 	if err != nil {
 		t.Fatalf("update profile: %v", err)

backend/internal/inttest/banner_console_test.go

@@ -256,7 +256,8 @@ func TestBannerSurvivesProfileUpdate(t *testing.T) {
 	id := provisionAccount(t)
 
 	body := `{"display_name":"Tester","preferred_language":"ru","time_zone":"UTC","away_start":"00:00",` +
-		`"away_end":"00:00","block_chat":false,"block_friend_requests":false,"notifications_in_app_only":true}`
+		`"away_end":"00:00","block_chat":false,"block_friend_requests":false,"notifications_in_app_only":true,` +
+		`"variant_preferences":["erudit_ru"]}`
 	rec := httptest.NewRecorder()
 	req := httptest.NewRequest(http.MethodPut, "/api/v1/user/profile", strings.NewReader(body))
 	req.Header.Set("X-User-ID", id.String())

backend/internal/inttest/email_test.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"errors"
 	"regexp"
+	"slices"
 	"testing"
 	"time"
 
@@ -134,12 +135,20 @@ func TestUpdateProfilePersists(t *testing.T) {
 	store := account.NewStore(testDB)
 	acc := provisionAccount(t)
 
+	// A fresh account defaults to Erudit only (the DB-level column default).
+	if def, err := store.GetByID(ctx, acc); err != nil {
+		t.Fatalf("get default: %v", err)
+	} else if want := []string{"erudit_ru"}; !slices.Equal(def.VariantPreferences, want) {
+		t.Errorf("default variant preferences = %v, want %v", def.VariantPreferences, want)
+	}
+
 	updated, err := store.UpdateProfile(ctx, acc, account.ProfileUpdate{
 		DisplayName:         "Kaya",
 		PreferredLanguage:   "ru",
 		TimeZone:            "Europe/Moscow",
 		BlockChat:           true,
 		BlockFriendRequests: true,
+		VariantPreferences:  []string{"scrabble_en", "erudit_ru"},
 	})
 	if err != nil {
 		t.Fatalf("update profile: %v", err)
@@ -157,6 +166,10 @@ func TestUpdateProfilePersists(t *testing.T) {
 	if reloaded.TimeZone != "Europe/Moscow" || !reloaded.BlockChat {
 		t.Errorf("profile did not persist: %+v", reloaded)
 	}
+	// The text[] column round-trips and is stored canonically (Erudit-first).
+	if want := []string{"erudit_ru", "scrabble_en"}; !slices.Equal(reloaded.VariantPreferences, want) {
+		t.Errorf("variant preferences = %v, want %v", reloaded.VariantPreferences, want)
+	}
 }
 
 // TestUpdateProfileOffsetTimezone checks the UTC-offset timezone: it is
@@ -167,9 +180,10 @@ func TestUpdateProfileOffsetTimezone(t *testing.T) {
 	acc := provisionAccount(t)
 
 	updated, err := store.UpdateProfile(ctx, acc, account.ProfileUpdate{
-		DisplayName:       "Kaya",
-		PreferredLanguage: "en",
-		TimeZone:          "+03:00",
+		DisplayName:        "Kaya",
+		PreferredLanguage:  "en",
+		TimeZone:           "+03:00",
+		VariantPreferences: []string{"erudit_ru"},
 	})
 	if err != nil {
 		t.Fatalf("update with offset timezone: %v", err)

backend/internal/inttest/feedback_test.go

@@ -145,48 +145,33 @@ func TestFeedbackReplyHiddenAfterNewMessage(t *testing.T) {
 	}
 }
 
-func TestFeedbackSnapshotsLanguages(t *testing.T) {
+func TestFeedbackSnapshotsLanguage(t *testing.T) {
 	ctx := context.Background()
 	svc := newFeedbackService()
 	acc := provisionAccount(t)
 	if _, err := testDB.ExecContext(ctx,
-		`UPDATE backend.accounts SET preferred_language = 'en', service_language = 'ru' WHERE account_id = $1`, acc); err != nil {
-		t.Fatalf("set languages: %v", err)
+		`UPDATE backend.accounts SET preferred_language = 'en' WHERE account_id = $1`, acc); err != nil {
+		t.Fatalf("set language: %v", err)
 	}
-	// A Telegram (connector) message snapshots both the interface language and the bot.
+	// A message snapshots the sender's interface language at submit time.
 	if err := svc.Submit(ctx, acc, "from telegram", nil, "", "telegram", ""); err != nil {
 		t.Fatalf("submit: %v", err)
 	}
 	id := latestFeedbackID(t, svc, acc)
 	if m, err := svc.AdminGet(ctx, id); err != nil {
 		t.Fatalf("admin get: %v", err)
-	} else if m.Lang != "en" || m.ChannelLang != "ru" {
-		t.Fatalf("snapshot = lang %q / channel_lang %q, want en / ru", m.Lang, m.ChannelLang)
+	} else if m.Lang != "en" {
+		t.Fatalf("snapshot = lang %q, want en", m.Lang)
 	}
 	// Changing the account afterwards must not change the stored snapshot.
 	if _, err := testDB.ExecContext(ctx,
-		`UPDATE backend.accounts SET preferred_language = 'ru', service_language = 'en' WHERE account_id = $1`, acc); err != nil {
-		t.Fatalf("change languages: %v", err)
+		`UPDATE backend.accounts SET preferred_language = 'ru' WHERE account_id = $1`, acc); err != nil {
+		t.Fatalf("change language: %v", err)
 	}
 	if m, err := svc.AdminGet(ctx, id); err != nil {
 		t.Fatal(err)
-	} else if m.Lang != "en" || m.ChannelLang != "ru" {
-		t.Fatalf("snapshot drifted after account change = lang %q / channel_lang %q", m.Lang, m.ChannelLang)
-	}
-
-	// A non-connector channel records no bot language even when the account has one.
-	acc2 := provisionAccount(t)
-	if _, err := testDB.ExecContext(ctx,
-		`UPDATE backend.accounts SET preferred_language = 'en', service_language = 'ru' WHERE account_id = $1`, acc2); err != nil {
-		t.Fatalf("set languages 2: %v", err)
-	}
-	if err := svc.Submit(ctx, acc2, "from web", nil, "", "web", ""); err != nil {
-		t.Fatalf("submit web: %v", err)
-	}
-	if m, err := svc.AdminGet(ctx, latestFeedbackID(t, svc, acc2)); err != nil {
-		t.Fatal(err)
-	} else if m.Lang != "en" || m.ChannelLang != "" {
-		t.Fatalf("web snapshot = lang %q / channel_lang %q, want en / empty", m.Lang, m.ChannelLang)
+	} else if m.Lang != "en" {
+		t.Fatalf("snapshot drifted after account change = lang %q, want en", m.Lang)
 	}
 }
 

backend/internal/inttest/game_limit_test.go

@@ -97,10 +97,12 @@ func TestGameLimitGate(t *testing.T) {
 	if !gamesListAtLimit(t, srv, human) {
 		t.Fatalf("at %d games at_game_limit must be true", game.MaxActiveQuickGames)
 	}
-	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", human, `{"variant":"scrabble_en"}`); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
+	// erudit_ru is in the default variant preferences, so the variant gate passes and the
+	// game-limit gate is what fires here.
+	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", human, `{"variant":"erudit_ru"}`); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
 		t.Fatalf("enqueue at limit = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
 	}
-	invBody := fmt.Sprintf(`{"variant":"scrabble_en","invitee_ids":[%q]}`, opp.String())
+	invBody := fmt.Sprintf(`{"variant":"erudit_ru","invitee_ids":[%q]}`, opp.String())
 	if rec := userPost(t, srv, "/api/v1/user/invitations", human, invBody); rec.Code != http.StatusConflict || errorCode(t, rec) != "game_limit_reached" {
 		t.Fatalf("invitation at limit = (%d, %q), want (409, game_limit_reached)", rec.Code, errorCode(t, rec))
 	}

backend/internal/inttest/seat_display_name_test.go

@@ -37,7 +37,7 @@ func TestSeatNameFrozenAfterRename(t *testing.T) {
 
 	starter := provisionAccount(t)
 	if _, err := accounts.UpdateProfile(ctx, starter, account.ProfileUpdate{
-		DisplayName: "Original Name", PreferredLanguage: "en", TimeZone: "UTC",
+		DisplayName: "Original Name", PreferredLanguage: "en", TimeZone: "UTC", VariantPreferences: []string{"erudit_ru"},
 	}); err != nil {
 		t.Fatalf("set name: %v", err)
 	}
@@ -50,7 +50,7 @@ func TestSeatNameFrozenAfterRename(t *testing.T) {
 
 	// Rename the account; the snapshot on the already-taken seat must not follow.
 	if _, err := accounts.UpdateProfile(ctx, starter, account.ProfileUpdate{
-		DisplayName: "Renamed Player99", PreferredLanguage: "en", TimeZone: "UTC",
+		DisplayName: "Renamed Player99", PreferredLanguage: "en", TimeZone: "UTC", VariantPreferences: []string{"erudit_ru"},
 	}); err != nil {
 		t.Fatalf("rename: %v", err)
 	}

backend/internal/inttest/social_test.go

@@ -135,7 +135,7 @@ func TestFriendRequestRefusedByToggleAndBlock(t *testing.T) {
 
 	// Toggle: the addressee does not accept friend requests.
 	a, b := provisionAccount(t), provisionAccount(t)
-	if _, err := store.UpdateProfile(ctx, b, account.ProfileUpdate{DisplayName: "Player", PreferredLanguage: "en", TimeZone: "UTC", BlockFriendRequests: true}); err != nil {
+	if _, err := store.UpdateProfile(ctx, b, account.ProfileUpdate{DisplayName: "Player", PreferredLanguage: "en", TimeZone: "UTC", BlockFriendRequests: true, VariantPreferences: []string{"erudit_ru"}}); err != nil {
 		t.Fatalf("set toggle: %v", err)
 	}
 	if err := svc.SendFriendRequest(ctx, a, b); !errors.Is(err, social.ErrRequestBlocked) {
@@ -353,7 +353,7 @@ func TestChatPostListAndBlocks(t *testing.T) {
 	if _, err := svc.PostMessage(ctx, other, seats2[0], "hi", ""); err != nil {
 		t.Fatalf("post 2: %v", err)
 	}
-	if _, err := store.UpdateProfile(ctx, seats2[1], account.ProfileUpdate{DisplayName: "Player", PreferredLanguage: "en", TimeZone: "UTC", BlockChat: true}); err != nil {
+	if _, err := store.UpdateProfile(ctx, seats2[1], account.ProfileUpdate{DisplayName: "Player", PreferredLanguage: "en", TimeZone: "UTC", BlockChat: true, VariantPreferences: []string{"erudit_ru"}}); err != nil {
 		t.Fatalf("set block_chat: %v", err)
 	}
 	if msgs, _ := svc.Messages(ctx, other, seats2[1]); len(msgs) != 0 {
@@ -588,32 +588,6 @@ func TestRespondPublishesToRequester(t *testing.T) {
 	}
 }
 
-// TestNudgeRoutedByGameLanguage checks a nudge's out-of-app push carries the game's language, so
-// it is delivered by the game's bot rather than the recipient's last-login bot.
-func TestNudgeRoutedByGameLanguage(t *testing.T) {
-	ctx := context.Background()
-	svc := newSocialService()
-	pub := &capturePublisher{}
-	svc.SetNotifier(pub)
-
-	gameID, seats := newGameWithSeats(t, 2) // an English game; seat 0 is to move
-	if _, err := svc.Nudge(ctx, gameID, seats[1]); err != nil {
-		t.Fatalf("nudge: %v", err)
-	}
-	found := false
-	for _, in := range pub.intents {
-		if in.Kind == notify.KindNudge {
-			found = true
-			if in.Language != "en" {
-				t.Errorf("nudge language = %q, want en (the game's language)", in.Language)
-			}
-		}
-	}
-	if !found {
-		t.Fatal("no nudge intent published")
-	}
-}
-
 // TestAdminListMessages checks the admin moderation list: real messages only
 // (nudges excluded), the game / sender pins, the sender glob masks, and the source label.
 func TestAdminListMessages(t *testing.T) {

backend/internal/inttest/variant_preference_test.go

@@ -0,0 +1,51 @@
+//go:build integration
+
+package inttest
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+	"time"
+
+	"go.uber.org/zap/zaptest"
+
+	"scrabble/backend/internal/account"
+	"scrabble/backend/internal/server"
+)
+
+// TestVariantPreferenceGate covers the New Game gate: a player may start a quick game
+// or create a friend invitation only in a variant they have enabled in their profile
+// (a fresh account defaults to Erudit only), and any other variant is refused with 400.
+// The complementary case — an invited friend accepting an invitation in a variant they
+// have NOT enabled — is exercised by TestGameLimitGate, where a default-Erudit human
+// accepts an English invitation over HTTP.
+func TestVariantPreferenceGate(t *testing.T) {
+	clearOpenGames(t)
+	srv := server.New(":0", server.Deps{
+		Logger:      zaptest.NewLogger(t),
+		DB:          testDB,
+		Accounts:    account.NewStore(testDB),
+		Games:       newGameService(),
+		Matchmaker:  newMatchmaker(t, newRobotService(t, newGameService()), time.Minute, 0),
+		Invitations: newInvitationService(),
+	})
+
+	human := provisionAccount(t) // default preferences: erudit_ru only
+	opp := provisionAccount(t)
+
+	// A variant outside the player's preferences is refused on both create paths.
+	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", human, `{"variant":"scrabble_en"}`); rec.Code != http.StatusBadRequest {
+		t.Fatalf("enqueue non-preferred variant = %d (%s), want 400", rec.Code, rec.Body.String())
+	}
+	invBody := fmt.Sprintf(`{"variant":"scrabble_en","invitee_ids":[%q]}`, opp.String())
+	if rec := userPost(t, srv, "/api/v1/user/invitations", human, invBody); rec.Code != http.StatusBadRequest {
+		t.Fatalf("invitation non-preferred variant = %d (%s), want 400", rec.Code, rec.Body.String())
+	}
+
+	// The default-enabled variant (Erudit) is allowed: the quick enqueue opens a game.
+	if rec := userPost(t, srv, "/api/v1/user/lobby/enqueue", human, `{"variant":"erudit_ru"}`); rec.Code != http.StatusOK {
+		t.Fatalf("enqueue preferred variant = %d (%s), want 200", rec.Code, rec.Body.String())
+	}
+	clearOpenGames(t)
+}