feat(telegram): split connector into home validator + remote bot

Move all Telegram egress off the main host. The single connector held the
bot token, long-polled Telegram and answered the gateway/backend over the
trusted internal network, so the whole component (including login validation)
shared fate with its VPN sidecar. Split it into two binaries that share the
token:

- cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only,
  never calls the Bot API. The gateway dials it for Telegram auth, so game
  login is now independent of Telegram reachability.
- cmd/bot (remote): Bot API long-poll + sendMessage, the only component
  reaching Telegram. It holds no inbound port — it dials the gateway over a
  new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send
  commands the gateway pushes.

The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget
(at-most-once, dropped if no bot is connected); the backend admin broadcasts
reach a gateway-served relay that forwards them and awaits the bot's ack
(SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one
inter-service link that leaves the trusted segment; validator<->gateway and
the relay stay plaintext internal. The bot is Telegram-rate-limited.

One bot now; the gateway bot registry, an owns_updates flag and per-command
ids leave seams for N later. Webhook rejected (one URL per token, adds inbound
+ a static address).

The unified test contour runs the split (the bot keeps its VPN sidecar and
dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh,
generated in CI). The prod wiring — the bot on a separate host (no VPN), the
gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH
deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX,
Stage 18).

Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway +
backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.

pkg/proto/botlink/v1/botlink_grpc.pb.go

@@ -0,0 +1,136 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.5.1
+// - protoc             (unknown)
+// source: botlink/v1/botlink.proto
+
+// Package scrabble.botlink.v1 is the reverse control channel between a remote
+// Telegram bot and the gateway. The bot dials the gateway and opens a single
+// long-lived Link stream (mTLS); once the stream is open the gateway pushes send
+// Commands down it and the bot returns one Ack per command. This keeps the bot
+// egress (the Bot API token, getUpdates long-poll and sendMessage) off the main
+// host with no inbound port on the bot. See docs/ARCHITECTURE.md.
+
+package botlinkv1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	BotLink_Link_FullMethodName = "/scrabble.botlink.v1.BotLink/Link"
+)
+
+// BotLinkClient is the client API for BotLink service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// BotLink is the reverse (bot-dials-gateway) control channel. The bot is the gRPC
+// client; once the stream is open the gateway (server) sends Commands at will and
+// the bot returns one Ack per command. Delivery is best-effort, at-most-once: a
+// command lost across a reconnect is not replayed.
+type BotLinkClient interface {
+	// Link opens the single bot <-> gateway stream. The first client message is
+	// Hello; thereafter the client sends one Ack per received Command.
+	Link(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[FromBot, ToBot], error)
+}
+
+type botLinkClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewBotLinkClient(cc grpc.ClientConnInterface) BotLinkClient {
+	return &botLinkClient{cc}
+}
+
+func (c *botLinkClient) Link(ctx context.Context, opts ...grpc.CallOption) (grpc.BidiStreamingClient[FromBot, ToBot], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &BotLink_ServiceDesc.Streams[0], BotLink_Link_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[FromBot, ToBot]{ClientStream: stream}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type BotLink_LinkClient = grpc.BidiStreamingClient[FromBot, ToBot]
+
+// BotLinkServer is the server API for BotLink service.
+// All implementations must embed UnimplementedBotLinkServer
+// for forward compatibility.
+//
+// BotLink is the reverse (bot-dials-gateway) control channel. The bot is the gRPC
+// client; once the stream is open the gateway (server) sends Commands at will and
+// the bot returns one Ack per command. Delivery is best-effort, at-most-once: a
+// command lost across a reconnect is not replayed.
+type BotLinkServer interface {
+	// Link opens the single bot <-> gateway stream. The first client message is
+	// Hello; thereafter the client sends one Ack per received Command.
+	Link(grpc.BidiStreamingServer[FromBot, ToBot]) error
+	mustEmbedUnimplementedBotLinkServer()
+}
+
+// UnimplementedBotLinkServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedBotLinkServer struct{}
+
+func (UnimplementedBotLinkServer) Link(grpc.BidiStreamingServer[FromBot, ToBot]) error {
+	return status.Errorf(codes.Unimplemented, "method Link not implemented")
+}
+func (UnimplementedBotLinkServer) mustEmbedUnimplementedBotLinkServer() {}
+func (UnimplementedBotLinkServer) testEmbeddedByValue()                 {}
+
+// UnsafeBotLinkServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to BotLinkServer will
+// result in compilation errors.
+type UnsafeBotLinkServer interface {
+	mustEmbedUnimplementedBotLinkServer()
+}
+
+func RegisterBotLinkServer(s grpc.ServiceRegistrar, srv BotLinkServer) {
+	// If the following call pancis, it indicates UnimplementedBotLinkServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&BotLink_ServiceDesc, srv)
+}
+
+func _BotLink_Link_Handler(srv interface{}, stream grpc.ServerStream) error {
+	return srv.(BotLinkServer).Link(&grpc.GenericServerStream[FromBot, ToBot]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type BotLink_LinkServer = grpc.BidiStreamingServer[FromBot, ToBot]
+
+// BotLink_ServiceDesc is the grpc.ServiceDesc for BotLink service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var BotLink_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "scrabble.botlink.v1.BotLink",
+	HandlerType: (*BotLinkServer)(nil),
+	Methods:     []grpc.MethodDesc{},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "Link",
+			Handler:       _BotLink_Link_Handler,
+			ServerStreams: true,
+			ClientStreams: true,
+		},
+	},
+	Metadata: "botlink/v1/botlink.proto",
+}