feat(telegram): split connector into home validator + remote bot

Move all Telegram egress off the main host. The single connector held the
bot token, long-polled Telegram and answered the gateway/backend over the
trusted internal network, so the whole component (including login validation)
shared fate with its VPN sidecar. Split it into two binaries that share the
token:

- cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only,
  never calls the Bot API. The gateway dials it for Telegram auth, so game
  login is now independent of Telegram reachability.
- cmd/bot (remote): Bot API long-poll + sendMessage, the only component
  reaching Telegram. It holds no inbound port — it dials the gateway over a
  new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send
  commands the gateway pushes.

The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget
(at-most-once, dropped if no bot is connected); the backend admin broadcasts
reach a gateway-served relay that forwards them and awaits the bot's ack
(SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one
inter-service link that leaves the trusted segment; validator<->gateway and
the relay stay plaintext internal. The bot is Telegram-rate-limited.

One bot now; the gateway bot registry, an owns_updates flag and per-command
ids leave seams for N later. Webhook rejected (one URL per token, adds inbound
+ a static address).

The unified test contour runs the split (the bot keeps its VPN sidecar and
dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh,
generated in CI). The prod wiring — the bot on a separate host (no VPN), the
gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH
deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX,
Stage 18).

Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway +
backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.

gateway/internal/connector/client.go

@@ -1,7 +1,9 @@
-// Package connector is the gateway's gRPC client for the Telegram connector
-// side-service: it validates Mini App initData and delivers out-of-app push. The
-// connector lives on the trusted internal network, so the connection uses insecure
-// (plaintext) transport credentials (ARCHITECTURE.md §12).
+// Package connector is the gateway's gRPC client for the Telegram validator
+// side-service: it validates Mini App initData and Login Widget data. The validator
+// lives on the trusted internal network and holds the bot token only for HMAC, so
+// the connection uses insecure (plaintext) transport credentials (ARCHITECTURE.md
+// §12). Out-of-app push no longer goes through this client; it is delivered to the
+// remote bot over the reverse mTLS bot-link (gateway/internal/botlink).
 package connector
 
 import (
@@ -92,18 +94,3 @@ func (c *Client) ValidateLoginWidget(ctx context.Context, data string) (User, er
 		FirstName:  resp.GetFirstName(),
 	}, nil
 }
-
-// Notify delivers an out-of-app notification for a push event; delivered reports
-// whether a message was actually sent.
-func (c *Client) Notify(ctx context.Context, externalID, kind string, payload []byte, language string) (bool, error) {
-	resp, err := c.c.Notify(ctx, &telegramv1.NotifyRequest{
-		ExternalId: externalID,
-		Kind:       kind,
-		Payload:    payload,
-		Language:   language,
-	})
-	if err != nil {
-		return false, err
-	}
-	return resp.GetDelivered(), nil
-}