feat(telegram): split connector into home validator + remote bot

Move all Telegram egress off the main host. The single connector held the
bot token, long-polled Telegram and answered the gateway/backend over the
trusted internal network, so the whole component (including login validation)
shared fate with its VPN sidecar. Split it into two binaries that share the
token:

- cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only,
  never calls the Bot API. The gateway dials it for Telegram auth, so game
  login is now independent of Telegram reachability.
- cmd/bot (remote): Bot API long-poll + sendMessage, the only component
  reaching Telegram. It holds no inbound port — it dials the gateway over a
  new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send
  commands the gateway pushes.

The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget
(at-most-once, dropped if no bot is connected); the backend admin broadcasts
reach a gateway-served relay that forwards them and awaits the bot's ack
(SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one
inter-service link that leaves the trusted segment; validator<->gateway and
the relay stay plaintext internal. The bot is Telegram-rate-limited.

One bot now; the gateway bot registry, an owns_updates flag and per-command
ids leave seams for N later. Webhook rejected (one URL per token, adds inbound
+ a static address).

The unified test contour runs the split (the bot keeps its VPN sidecar and
dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh,
generated in CI). The prod wiring — the bot on a separate host (no VPN), the
gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH
deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX,
Stage 18).

Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway +
backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.

platform/telegram/internal/botlink/client_test.go

@@ -0,0 +1,87 @@
+package botlink
+
+import (
+	"fmt"
+	"net"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	botlinkv1 "scrabble/pkg/proto/botlink/v1"
+	telegramv1 "scrabble/pkg/proto/telegram/v1"
+)
+
+// testLinkServer registers one bot, pushes a single Notify command, and records the
+// Ack the client returns.
+type testLinkServer struct {
+	botlinkv1.UnimplementedBotLinkServer
+	acks chan *botlinkv1.Ack
+}
+
+func (s *testLinkServer) Link(stream grpc.BidiStreamingServer[botlinkv1.FromBot, botlinkv1.ToBot]) error {
+	hello, err := stream.Recv()
+	if err != nil {
+		return err
+	}
+	if hello.GetHello() == nil {
+		return fmt.Errorf("first message was not Hello")
+	}
+	if err := stream.Send(&botlinkv1.ToBot{Command: &botlinkv1.Command{
+		CommandId: "c1",
+		Payload: &botlinkv1.Command_Notify{Notify: &telegramv1.NotifyRequest{
+			ExternalId: "12345", Kind: "your_turn",
+			Payload: yourTurnPayload("7c9e6679-7425-40de-944b-e07fc1f90ae7"), Language: "en",
+		}},
+	}}); err != nil {
+		return err
+	}
+	for {
+		msg, err := stream.Recv()
+		if err != nil {
+			return err
+		}
+		if ack := msg.GetAck(); ack != nil {
+			s.acks <- ack
+			return nil
+		}
+	}
+}
+
+// TestClientServesCommands verifies the bot client dials, registers, executes a
+// pushed command through the executor, and acks it.
+func TestClientServesCommands(t *testing.T) {
+	lis, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	ts := &testLinkServer{acks: make(chan *botlinkv1.Ack, 1)}
+	srv := grpc.NewServer()
+	botlinkv1.RegisterBotLinkServer(srv, ts)
+	go func() { _ = srv.Serve(lis) }()
+	t.Cleanup(srv.Stop)
+
+	sender := &fakeSender{}
+	client := NewClient(ClientConfig{
+		GatewayAddr:    lis.Addr().String(),
+		InstanceID:     "test",
+		Creds:          insecure.NewCredentials(),
+		ReconnectDelay: 50 * time.Millisecond,
+	}, NewExecutor(sender, 0, nil), nil)
+
+	go func() { _ = client.Run(t.Context()) }()
+
+	select {
+	case ack := <-ts.acks:
+		if ack.GetCommandId() != "c1" || !ack.GetDelivered() {
+			t.Errorf("ack = %+v, want command_id c1 delivered=true", ack)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("server received no ack")
+	}
+	// The channel receive above happens-after the client wrote the sender call.
+	if len(sender.notify) != 1 || sender.notify[0].chatID != 12345 {
+		t.Errorf("sender notify calls = %+v, want one call to chat 12345", sender.notify)
+	}
+}