feat(telegram): split connector into home validator + remote bot

Move all Telegram egress off the main host. The single connector held the
bot token, long-polled Telegram and answered the gateway/backend over the
trusted internal network, so the whole component (including login validation)
shared fate with its VPN sidecar. Split it into two binaries that share the
token:

- cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only,
  never calls the Bot API. The gateway dials it for Telegram auth, so game
  login is now independent of Telegram reachability.
- cmd/bot (remote): Bot API long-poll + sendMessage, the only component
  reaching Telegram. It holds no inbound port — it dials the gateway over a
  new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send
  commands the gateway pushes.

The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget
(at-most-once, dropped if no bot is connected); the backend admin broadcasts
reach a gateway-served relay that forwards them and awaits the bot's ack
(SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one
inter-service link that leaves the trusted segment; validator<->gateway and
the relay stay plaintext internal. The bot is Telegram-rate-limited.

One bot now; the gateway bot registry, an owns_updates flag and per-command
ids leave seams for N later. Webhook rejected (one URL per token, adds inbound
+ a static address).

The unified test contour runs the split (the bot keeps its VPN sidecar and
dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh,
generated in CI). The prod wiring — the bot on a separate host (no VPN), the
gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH
deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX,
Stage 18).

Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway +
backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.

platform/telegram/internal/bot/bot.go

@@ -13,6 +13,7 @@ import (
 	tgbot "github.com/go-telegram/bot"
 	"github.com/go-telegram/bot/models"
 	"go.uber.org/zap"
+	"golang.org/x/time/rate"
 )
 
 // Config configures the bot wrapper.
@@ -25,6 +26,10 @@ type Config struct {
 	TestEnv bool
 	// MiniAppURL is the base URL of the Mini App launch button.
 	MiniAppURL string
+	// SendRatePerSecond caps outbound sends (Notify and SendText) to respect the
+	// Telegram Bot API flood limits; 0 disables the limiter. The burst equals the
+	// per-second rate.
+	SendRatePerSecond int
 }
 
 // Bot wraps a Telegram Bot API client and the Mini App launch URL.
@@ -32,6 +37,9 @@ type Bot struct {
 	api        *tgbot.Bot
 	miniAppURL string
 	log        *zap.Logger
+	// limiter throttles outbound sends to stay under the Bot API flood limits; nil
+	// disables throttling.
+	limiter *rate.Limiter
 }
 
 // New builds the bot wrapper, registering the /start handler and a default handler
@@ -42,6 +50,9 @@ func New(cfg Config, log *zap.Logger) (*Bot, error) {
 		log = zap.NewNop()
 	}
 	t := &Bot{miniAppURL: cfg.MiniAppURL, log: log}
+	if cfg.SendRatePerSecond > 0 {
+		t.limiter = rate.NewLimiter(rate.Limit(cfg.SendRatePerSecond), cfg.SendRatePerSecond)
+	}
 
 	opts := []tgbot.Option{
 		tgbot.WithDefaultHandler(t.handleStart),
@@ -85,6 +96,9 @@ func (t *Bot) Run(ctx context.Context) {
 // Notify sends a notification message with a Mini App launch button that opens the
 // app at startParam (empty opens the lobby).
 func (t *Bot) Notify(ctx context.Context, chatID int64, text, buttonText, startParam string) error {
+	if err := t.throttle(ctx); err != nil {
+		return err
+	}
 	_, err := t.api.SendMessage(ctx, &tgbot.SendMessageParams{
 		ChatID:      chatID,
 		Text:        text,
@@ -95,10 +109,22 @@ func (t *Bot) Notify(ctx context.Context, chatID int64, text, buttonText, startP
 
 // SendText sends a plain text message with no markup (admin use).
 func (t *Bot) SendText(ctx context.Context, chatID int64, text string) error {
+	if err := t.throttle(ctx); err != nil {
+		return err
+	}
 	_, err := t.api.SendMessage(ctx, &tgbot.SendMessageParams{ChatID: chatID, Text: text})
 	return err
 }
 
+// throttle blocks until the rate limiter admits one send, or ctx is cancelled. It
+// is a no-op when no limiter is configured.
+func (t *Bot) throttle(ctx context.Context) error {
+	if t.limiter == nil {
+		return nil
+	}
+	return t.limiter.Wait(ctx)
+}
+
 // handleStart replies to /start (with an optional deep-link payload) and to any
 // other message with a Mini App launch button.
 func (t *Bot) handleStart(ctx context.Context, api *tgbot.Bot, update *models.Update) {