fix(vk): friend-code link as ?hash, Android safe-area via bridge insets, landscape home-bar colour

Contour review of the VK Bridge group:

- #6 invite link: VK's documented '#' direct-link payload is eaten by the vk.com SPA before it
  reaches the app, so the friend-code link now carries the payload as a query param
  (vk.com/app<id>?hash=f<code>); the recipient already reads the `hash` query param (vkStartParam).
  (Whether VK forwards the '?' through to the iframe is being confirmed on the contour.)
- #8 Android: the VK mobile webview does not surface the home-bar inset via CSS env() (config
  insets are iOS-only), so subscribe to the bridge insets (VKWebAppUpdateConfig + VKWebAppUpdateInsets)
  and set --tg-safe-* to max(env(), the VK value).
- #8 landscape colour: the home-indicator strip was the (grey) page background because the two-pane
  landscape game has no bottom bar. The left-panel controls bar now paints its own chrome into the
  inset (Screen gains a selfInset flag that drops the shell's detached padding strip), and the
  game-land runs flush to the edge.

Verified: svelte-check, 347 unit, build, bundle-gate; the landscape safe-area painting reproduced in
the mock (controls bar + board reach the edge, strip takes the bar colour). The VK-Bridge / VK launch
behaviours (Android insets, the ?hash forward) need the live contour.

ui/src/lib/deeplink.ts

@@ -78,14 +78,14 @@ export function shareLink(param: string): string | null {
 }
 
 /**
- * vkShareLink wraps a deep-link start parameter in a VK Mini App direct link
- * (https://vk.com/app<id>#<param>). VK forwards everything after the '#' to the app as the `hash`
- * launch parameter (read back by vk.ts vkStartParam); a query string ('?') is not supported for VK
- * direct links. Returns null when the VK app id is unknown (outside a VK launch), so the caller
- * falls back to the Telegram/web link.
+ * vkShareLink wraps a deep-link start parameter in a VK Mini App link
+ * (https://vk.com/app<id>?hash=<param>), read back by vk.ts vkStartParam (the `hash` query param).
+ * VK's documented '#' direct-link form is consumed by the vk.com SPA before it reaches the app, so
+ * we pass the payload as a query parameter instead. Returns null when the VK app id is unknown
+ * (outside a VK launch), so the caller falls back to the Telegram/web link.
  */
 export function vkShareLink(param: string): string | null {
   const id = vkAppId();
   if (!id) return null;
-  return `https://vk.com/app${id}#${param}`;
+  return `https://vk.com/app${id}?hash=${encodeURIComponent(param)}`;
 }