feat(telegram): split connector into home validator + remote bot

Move all Telegram egress off the main host. The single connector held the
bot token, long-polled Telegram and answered the gateway/backend over the
trusted internal network, so the whole component (including login validation)
shared fate with its VPN sidecar. Split it into two binaries that share the
token:

- cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only,
  never calls the Bot API. The gateway dials it for Telegram auth, so game
  login is now independent of Telegram reachability.
- cmd/bot (remote): Bot API long-poll + sendMessage, the only component
  reaching Telegram. It holds no inbound port — it dials the gateway over a
  new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send
  commands the gateway pushes.

The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget
(at-most-once, dropped if no bot is connected); the backend admin broadcasts
reach a gateway-served relay that forwards them and awaits the bot's ack
(SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one
inter-service link that leaves the trusted segment; validator<->gateway and
the relay stay plaintext internal. The bot is Telegram-rate-limited.

One bot now; the gateway bot registry, an owns_updates flag and per-command
ids leave seams for N later. Webhook rejected (one URL per token, adds inbound
+ a static address).

The unified test contour runs the split (the bot keeps its VPN sidecar and
dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh,
generated in CI). The prod wiring — the bot on a separate host (no VPN), the
gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH
deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX,
Stage 18).

Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway +
backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.

platform/telegram/internal/botlink/executor.go

@@ -0,0 +1,110 @@
+// Package botlink is the bot side of the reverse Telegram channel: the bot dials
+// the gateway over mTLS (pkg/proto/botlink/v1), opens one long-lived Link stream,
+// and executes the send Commands the gateway pushes, replying with an Ack per
+// command. It keeps the Bot API token and egress on the remote bot host with no
+// inbound port. See docs/ARCHITECTURE.md.
+package botlink
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+
+	"go.uber.org/zap"
+
+	botlinkv1 "scrabble/pkg/proto/botlink/v1"
+	telegramv1 "scrabble/pkg/proto/telegram/v1"
+	"scrabble/platform/telegram/internal/render"
+)
+
+// Sender delivers Telegram messages to a chat. *bot.Bot implements it.
+type Sender interface {
+	// Notify sends a notification with a Mini App launch button to chatID.
+	Notify(ctx context.Context, chatID int64, text, buttonText, startParam string) error
+	// SendText sends a plain text message to chatID.
+	SendText(ctx context.Context, chatID int64, text string) error
+}
+
+// Executor turns a bot-link Command into a Bot API send. The delivered flag mirrors
+// the former connector semantics (false when the kind is not rendered out-of-app,
+// the user never started the bot, or no channel is configured); a returned error is
+// an unexpected or malformed failure carried back in the Ack error field, distinct
+// from a clean not-delivered.
+type Executor struct {
+	sender    Sender
+	channelID int64
+	log       *zap.Logger
+}
+
+// NewExecutor builds the executor over a bot sender and the optional game channel.
+func NewExecutor(sender Sender, channelID int64, log *zap.Logger) *Executor {
+	if log == nil {
+		log = zap.NewNop()
+	}
+	return &Executor{sender: sender, channelID: channelID, log: log}
+}
+
+// Handle dispatches one command to the matching Bot API send.
+func (e *Executor) Handle(ctx context.Context, cmd *botlinkv1.Command) (bool, error) {
+	switch p := cmd.GetPayload().(type) {
+	case *botlinkv1.Command_Notify:
+		return e.notify(ctx, p.Notify)
+	case *botlinkv1.Command_SendToUser:
+		return e.sendToUser(ctx, p.SendToUser)
+	case *botlinkv1.Command_SendToChannel:
+		return e.sendToChannel(ctx, p.SendToChannel)
+	default:
+		return false, fmt.Errorf("botlink: empty command")
+	}
+}
+
+// notify renders an out-of-app push and sends it with a Mini App launch button.
+func (e *Executor) notify(ctx context.Context, req *telegramv1.NotifyRequest) (bool, error) {
+	msg, ok := render.Render(req.GetKind(), req.GetPayload(), req.GetLanguage())
+	if !ok {
+		return false, nil
+	}
+	chat, err := parseChatID(req.GetExternalId())
+	if err != nil {
+		return false, err
+	}
+	if err := e.sender.Notify(ctx, chat, msg.Text, msg.ButtonText, msg.StartParam); err != nil {
+		e.log.Warn("notify delivery failed", zap.String("kind", req.GetKind()), zap.Error(err))
+		return false, nil
+	}
+	return true, nil
+}
+
+// sendToUser sends an admin text message to one user.
+func (e *Executor) sendToUser(ctx context.Context, req *telegramv1.SendToUserRequest) (bool, error) {
+	chat, err := parseChatID(req.GetExternalId())
+	if err != nil {
+		return false, err
+	}
+	if err := e.sender.SendText(ctx, chat, req.GetText()); err != nil {
+		e.log.Warn("send to user failed", zap.Error(err))
+		return false, nil
+	}
+	return true, nil
+}
+
+// sendToChannel posts an admin text message to the bot's game channel.
+func (e *Executor) sendToChannel(ctx context.Context, req *telegramv1.SendToGameChannelRequest) (bool, error) {
+	if e.channelID == 0 {
+		return false, fmt.Errorf("botlink: game channel is not configured")
+	}
+	if err := e.sender.SendText(ctx, e.channelID, req.GetText()); err != nil {
+		e.log.Warn("send to channel failed", zap.Error(err))
+		return false, nil
+	}
+	return true, nil
+}
+
+// parseChatID converts a Telegram identity external_id into a numeric chat id.
+func parseChatID(externalID string) (int64, error) {
+	id, err := strconv.ParseInt(externalID, 10, 64)
+	if err != nil {
+		return 0, fmt.Errorf("invalid external_id %q", externalID)
+	}
+	return id, nil
+}