fix(vk): persist settings via VK Bridge storage; hide competing sign-in in Mini App hosts

VK moderation follow-ups.

1. Settings (theme, language, board style, reduce-motion, zoom, first-run
   coachmark flags) were lost between reloads in VK's desktop iframe: Firefox
   partitions/blocks IndexedDB and localStorage in a cross-origin iframe, so the
   browser-local store is empty on every reload (a plain tab / PWA keeps them —
   first-party storage — and Telegram has its own CloudStorage sync). Mirror the
   prefs (plus the locale, which has no other durable client home on VK) and the
   coachmark flags to VK Bridge storage (VKWebAppStorageSet/Get), which travels
   over postMessage to vk.com and survives; reconcile them on the VK launch
   before the first paint. The VK identity re-derives from the signed launch
   params each load, so the values reload onto the same account.

2. Inside a proprietary Mini App host (VK or Telegram) the profile now surfaces
   only email linking — both the Telegram and VK link/unlink entries are hidden
   (signInProvidersVisible), so a competing sign-in is never advertised (a
   platform ToS requirement; VK forbids showing a Telegram login, mirrored in
   Telegram for VK). A provider linked earlier on the web stays attached and is
   managed from the web; web/native builds show both.

Tests: vkprefs codec + signInProvidersVisible unit tests. Docs: ARCHITECTURE,
FUNCTIONAL (+_ru). No schema/wire change.

docs/ARCHITECTURE.md

@@ -47,7 +47,16 @@ Three executables plus per-platform side-services:
   insets (the bottom/home-indicator strip taking the bottom bar's colour), exposes
   Telegram's native **Settings** button into the in-app settings, and syncs the
   device-independent display preferences (theme, reduce-motion, board labels — **not** the
-  interface language) across the user's Telegram devices via **CloudStorage**.
+  interface language) across the user's Telegram devices via **CloudStorage**. Inside the **VK
+  Mini App** the same preferences — **plus** the interface language and the first-run coachmark
+  flags — are instead mirrored to **VK Bridge storage** (`VKWebAppStorageSet`/`Get`,
+  `lib/vkprefs.ts` + `lib/vk.ts`, reconciled on launch): VK's cross-origin desktop iframe
+  (notably in Firefox) partitions or blocks the browser's IndexedDB/localStorage, so the local
+  store is lost across reloads there, while VK Bridge storage travels over the postMessage channel
+  to vk.com and survives; the VK identity re-derives from the signed launch parameters each load,
+  so the values reload onto the same account. The locale rides this store because on VK it has no
+  other durable client home (`preferred_language` is written from the client but never read back).
+  A plain browser tab / PWA keeps everything in first-party storage.
 - **`platform/telegram`** — the Telegram side-service (module
   `scrabble/platform/telegram`), split into two binaries that share the bot token
   (**one bot**, one optional game channel, §3):
@@ -361,7 +370,12 @@ arrive from a platform rather than completing a mandatory registration).
 - **Unlink** detaches a platform identity (`telegram`/`vk`) from the profile. The
   backend **refuses removing the last identity** (`ErrLastIdentity`), so an account
   never becomes unreachable; the UI mirrors the guard by hiding Unlink when only one
-  method remains. **Email is never unlinked — it is changed.**
+  method remains. **Email is never unlinked — it is changed.** **Inside a proprietary Mini App
+  host (VK or Telegram) the profile surfaces only email linking** — both providers' link and
+  unlink entries are hidden there (`profileValidation.signInProvidersVisible`), so a competing
+  sign-in is never advertised: a platform ToS requirement (VK forbids showing a Telegram login,
+  mirrored in Telegram for VK). A provider linked earlier on the web stays attached and is managed
+  from the web; the web and native builds show both providers.
 - **Change email** mails a confirm-code (`purpose=change`) to the new address on the
   authenticated account and, on confirm (code or one-tap deeplink), **atomically
   replaces** the account's email identity with the new one, freeing the old address. A