feat(telegram): split connector into home validator + remote bot

Move all Telegram egress off the main host. The single connector held the
bot token, long-polled Telegram and answered the gateway/backend over the
trusted internal network, so the whole component (including login validation)
shared fate with its VPN sidecar. Split it into two binaries that share the
token:

- cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only,
  never calls the Bot API. The gateway dials it for Telegram auth, so game
  login is now independent of Telegram reachability.
- cmd/bot (remote): Bot API long-poll + sendMessage, the only component
  reaching Telegram. It holds no inbound port — it dials the gateway over a
  new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send
  commands the gateway pushes.

The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget
(at-most-once, dropped if no bot is connected); the backend admin broadcasts
reach a gateway-served relay that forwards them and awaits the bot's ack
(SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one
inter-service link that leaves the trusted segment; validator<->gateway and
the relay stay plaintext internal. The bot is Telegram-rate-limited.

One bot now; the gateway bot registry, an owns_updates flag and per-command
ids leave seams for N later. Webhook rejected (one URL per token, adds inbound
+ a static address).

The unified test contour runs the split (the bot keeps its VPN sidecar and
dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh,
generated in CI). The prod wiring — the bot on a separate host (no VPN), the
gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH
deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX,
Stage 18).

Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway +
backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.

platform/telegram/Dockerfile

@@ -1,11 +1,14 @@
-# Telegram connector image.
+# Telegram platform images: the home validator (HMAC of Mini App / Login Widget
+# data, no Bot API, no VPN) and the remote bot (Bot API long-poll + sendMessage,
+# dialing the gateway over the reverse mTLS bot-link). One build stage compiles both
+# binaries; the `validator` and `bot` targets each ship one on distroless nonroot.
 #
-# The connector imports only the shared scrabble/pkg module, so the build drops the
+# The platform imports only the shared scrabble/pkg module, so the build drops the
 # other workspace modules (backend, gateway, loadtest), the loadtest-only
 # scrabble/gateway replace and the scrabble-solver replace from a copy of go.work: it
 # needs neither their sources nor the solver sibling checkout.
 # Build from the repository ROOT so go.work, pkg/ and platform/telegram/ are all in
-# the context (see deploy/docker-compose.yml, which sets context: ../../..).
+# the context (see deploy/docker-compose.yml, which sets context: ..).
 FROM golang:1.26.3-alpine AS build
 WORKDIR /src
 
@@ -13,11 +16,18 @@ COPY go.work go.work.sum ./
 COPY pkg ./pkg
 COPY platform/telegram ./platform/telegram
 
-# Reduce the workspace to what the connector needs: only pkg + platform/telegram.
+# Reduce the workspace to what the platform needs: only pkg + platform/telegram.
 RUN go work edit -dropuse=./backend -dropuse=./gateway -dropuse=./loadtest -dropreplace=scrabble/gateway@v0.0.0 -dropreplace=scrabble-solver
 
-RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/telegram ./platform/telegram/cmd/telegram
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/validator ./platform/telegram/cmd/validator
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/bot ./platform/telegram/cmd/bot
 
-FROM gcr.io/distroless/static-debian12:nonroot
-COPY --from=build /out/telegram /usr/local/bin/telegram
-ENTRYPOINT ["/usr/local/bin/telegram"]
+# --- validator (home) --------------------------------------------------------
+FROM gcr.io/distroless/static-debian12:nonroot AS validator
+COPY --from=build /out/validator /usr/local/bin/validator
+ENTRYPOINT ["/usr/local/bin/validator"]
+
+# --- bot (remote) ------------------------------------------------------------
+FROM gcr.io/distroless/static-debian12:nonroot AS bot
+COPY --from=build /out/bot /usr/local/bin/bot
+ENTRYPOINT ["/usr/local/bin/bot"]