feat(payments): Telegram Stars payment rail

Accept real money via Telegram Stars (XTR) — the third intake rail
alongside Robokassa (direct) and VK Votes.

Only the bot reaches Telegram, so the rail funnels through the reverse
mTLS bot-link:
- the gateway mints the invoice on a CreateInvoice command (the bot
  calls createInvoiceLink, XTR; the link goes to WebApp.openInvoice);
- the bot gates each pre_checkout_query via a ValidatePreCheckout unary
  (the order must exist, be still creditable and not already paid — the
  reusable-invoice double-pay guard; the decline reason is localised to
  the order account's language);
- a completed successful_payment is queued in a durable pure-Go SQLite
  outbox and forwarded via a ForwardPayment unary, credited once
  (idempotent on telegram_payment_charge_id, honours an expired order),
  re-driven on restart and every 30s.

The rail is wired by TELEGRAM_STARS_OUTBOX_DIR (default /data) but stays
inert until a chip pack carries an XTR price, so seeding a Stars price in
the admin is the go-live.

Tests: backend integration (order->forward->credit once, duplicate,
pre_checkout gate) + bot outbox unit (idempotent, restart re-drive) +
executor createInvoice. Docs: PAYMENTS(+ru) §9, ARCHITECTURE, the
platform/telegram README, PLAN.

pkg/proto/botlink/v1/botlink_grpc.pb.go

@@ -28,6 +28,8 @@ const _ = grpc.SupportPackageIsVersion9
 const (
 	BotLink_Link_FullMethodName                   = "/scrabble.botlink.v1.BotLink/Link"
 	BotLink_ResolveChatEligibility_FullMethodName = "/scrabble.botlink.v1.BotLink/ResolveChatEligibility"
+	BotLink_ValidatePreCheckout_FullMethodName    = "/scrabble.botlink.v1.BotLink/ValidatePreCheckout"
+	BotLink_ForwardPayment_FullMethodName         = "/scrabble.botlink.v1.BotLink/ForwardPayment"
 )
 
 // BotLinkClient is the client API for BotLink service.
@@ -48,6 +50,22 @@ type BotLinkClient interface {
 	// same mTLS channel when a user joins the chat, to decide whether to grant the
 	// write permission. Delivery of the answer is request/response (not best-effort).
 	ResolveChatEligibility(ctx context.Context, in *ChatEligibilityRequest, opts ...grpc.CallOption) (*ChatEligibilityResponse, error)
+	// ValidatePreCheckout answers whether a Telegram Stars pre_checkout_query may be
+	// approved before any star is charged: the order in the invoice payload exists, is
+	// still creditable (pending or an honoured-expired order, never one already paid),
+	// and its amount and currency match the invoice. The bot calls it on every
+	// pre_checkout_query and approves only on ok; a not-ok answer or a channel failure
+	// declines the charge (fail-closed). Reusable Stars invoice links make this gate the
+	// one place a repeat payment is stopped before money moves. Request/response.
+	ValidatePreCheckout(ctx context.Context, in *PreCheckoutRequest, opts ...grpc.CallOption) (*PreCheckoutResponse, error)
+	// ForwardPayment delivers a completed Telegram Stars payment from the bot's durable
+	// outbox to the gateway for crediting. The bot calls it (retrying until it gets a
+	// response) after Telegram confirms the payment; the gateway forwards it to the
+	// backend intake, which credits the order once, idempotent on
+	// telegram_payment_charge_id. A response means the payment was durably handled
+	// (credited, or recorded as unmatched) and the bot may forget the outbox row; a
+	// transport error leaves the row for a later retry. Request/response.
+	ForwardPayment(ctx context.Context, in *ForwardPaymentRequest, opts ...grpc.CallOption) (*ForwardPaymentResponse, error)
 }
 
 type botLinkClient struct {
@@ -81,6 +99,26 @@ func (c *botLinkClient) ResolveChatEligibility(ctx context.Context, in *ChatElig
 	return out, nil
 }
 
+func (c *botLinkClient) ValidatePreCheckout(ctx context.Context, in *PreCheckoutRequest, opts ...grpc.CallOption) (*PreCheckoutResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PreCheckoutResponse)
+	err := c.cc.Invoke(ctx, BotLink_ValidatePreCheckout_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *botLinkClient) ForwardPayment(ctx context.Context, in *ForwardPaymentRequest, opts ...grpc.CallOption) (*ForwardPaymentResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ForwardPaymentResponse)
+	err := c.cc.Invoke(ctx, BotLink_ForwardPayment_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // BotLinkServer is the server API for BotLink service.
 // All implementations must embed UnimplementedBotLinkServer
 // for forward compatibility.
@@ -99,6 +137,22 @@ type BotLinkServer interface {
 	// same mTLS channel when a user joins the chat, to decide whether to grant the
 	// write permission. Delivery of the answer is request/response (not best-effort).
 	ResolveChatEligibility(context.Context, *ChatEligibilityRequest) (*ChatEligibilityResponse, error)
+	// ValidatePreCheckout answers whether a Telegram Stars pre_checkout_query may be
+	// approved before any star is charged: the order in the invoice payload exists, is
+	// still creditable (pending or an honoured-expired order, never one already paid),
+	// and its amount and currency match the invoice. The bot calls it on every
+	// pre_checkout_query and approves only on ok; a not-ok answer or a channel failure
+	// declines the charge (fail-closed). Reusable Stars invoice links make this gate the
+	// one place a repeat payment is stopped before money moves. Request/response.
+	ValidatePreCheckout(context.Context, *PreCheckoutRequest) (*PreCheckoutResponse, error)
+	// ForwardPayment delivers a completed Telegram Stars payment from the bot's durable
+	// outbox to the gateway for crediting. The bot calls it (retrying until it gets a
+	// response) after Telegram confirms the payment; the gateway forwards it to the
+	// backend intake, which credits the order once, idempotent on
+	// telegram_payment_charge_id. A response means the payment was durably handled
+	// (credited, or recorded as unmatched) and the bot may forget the outbox row; a
+	// transport error leaves the row for a later retry. Request/response.
+	ForwardPayment(context.Context, *ForwardPaymentRequest) (*ForwardPaymentResponse, error)
 	mustEmbedUnimplementedBotLinkServer()
 }
 
@@ -115,6 +169,12 @@ func (UnimplementedBotLinkServer) Link(grpc.BidiStreamingServer[FromBot, ToBot])
 func (UnimplementedBotLinkServer) ResolveChatEligibility(context.Context, *ChatEligibilityRequest) (*ChatEligibilityResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ResolveChatEligibility not implemented")
 }
+func (UnimplementedBotLinkServer) ValidatePreCheckout(context.Context, *PreCheckoutRequest) (*PreCheckoutResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ValidatePreCheckout not implemented")
+}
+func (UnimplementedBotLinkServer) ForwardPayment(context.Context, *ForwardPaymentRequest) (*ForwardPaymentResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ForwardPayment not implemented")
+}
 func (UnimplementedBotLinkServer) mustEmbedUnimplementedBotLinkServer() {}
 func (UnimplementedBotLinkServer) testEmbeddedByValue()                 {}
 
@@ -161,6 +221,42 @@ func _BotLink_ResolveChatEligibility_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _BotLink_ValidatePreCheckout_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PreCheckoutRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BotLinkServer).ValidatePreCheckout(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: BotLink_ValidatePreCheckout_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BotLinkServer).ValidatePreCheckout(ctx, req.(*PreCheckoutRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _BotLink_ForwardPayment_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ForwardPaymentRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(BotLinkServer).ForwardPayment(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: BotLink_ForwardPayment_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(BotLinkServer).ForwardPayment(ctx, req.(*ForwardPaymentRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // BotLink_ServiceDesc is the grpc.ServiceDesc for BotLink service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -172,6 +268,14 @@ var BotLink_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "ResolveChatEligibility",
 			Handler:    _BotLink_ResolveChatEligibility_Handler,
 		},
+		{
+			MethodName: "ValidatePreCheckout",
+			Handler:    _BotLink_ValidatePreCheckout_Handler,
+		},
+		{
+			MethodName: "ForwardPayment",
+			Handler:    _BotLink_ForwardPayment_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{