feat(payments): Telegram Stars payment rail

Accept real money via Telegram Stars (XTR) — the third intake rail
alongside Robokassa (direct) and VK Votes.

Only the bot reaches Telegram, so the rail funnels through the reverse
mTLS bot-link:
- the gateway mints the invoice on a CreateInvoice command (the bot
  calls createInvoiceLink, XTR; the link goes to WebApp.openInvoice);
- the bot gates each pre_checkout_query via a ValidatePreCheckout unary
  (the order must exist, be still creditable and not already paid — the
  reusable-invoice double-pay guard; the decline reason is localised to
  the order account's language);
- a completed successful_payment is queued in a durable pure-Go SQLite
  outbox and forwarded via a ForwardPayment unary, credited once
  (idempotent on telegram_payment_charge_id, honours an expired order),
  re-driven on restart and every 30s.

The rail is wired by TELEGRAM_STARS_OUTBOX_DIR (default /data) but stays
inert until a chip pack carries an XTR price, so seeding a Stars price in
the admin is the go-live.

Tests: backend integration (order->forward->credit once, duplicate,
pre_checkout gate) + bot outbox unit (idempotent, restart re-drive) +
executor createInvoice. Docs: PAYMENTS(+ru) §9, ARCHITECTURE, the
platform/telegram README, PLAN.

platform/telegram/README.md

@@ -91,6 +91,16 @@ Telegram identity to an account from a browser. Both map a rejection to gRPC
   the seeded Mini App rather than the bot profile.
 - **Rate limiting.** Outbound sends are throttled (`TELEGRAM_SEND_RATE_PER_SECOND`,
   default 25) to respect the Bot API flood limits.
+- **Payments (Telegram Stars).** When `TELEGRAM_STARS_OUTBOX_DIR` is set (default `/data`), the
+  bot handles the Stars rail. Only the bot reaches Telegram, so it mints the invoice on a
+  `CreateInvoice` bot-link command (`createInvoiceLink`, XTR — the link goes back to the Mini App
+  for `WebApp.openInvoice`); it gates each `pre_checkout_query` through the bot-link
+  (`ValidatePreCheckout`, backed by the backend intake — declining an already-paid reusable
+  invoice before the charge); and it records each `successful_payment` in a durable **SQLite
+  outbox** (`internal/outbox`, `stars.db` on the writable volume) before forwarding it over the
+  bot-link (`ForwardPayment`). The outbox is re-driven on startup and every 30 s, so a gateway or
+  backend outage never loses a paid order; crediting is idempotent on `telegram_payment_charge_id`.
+  The rail stays inert until a chip pack carries an XTR price (seeded in the admin).
 
 The send commands address a recipient by the identity `external_id` (as in the backend
 `identities` table), so a future VK / MAX bot reuses them; only the validator's initData
@@ -104,9 +114,11 @@ parsing is Telegram-specific.
   gateway also implements `SendToUser` / `SendToGameChannel` as the backend's admin
   relay.
 - `pkg/proto/botlink/v1`, service `BotLink` — the reverse bidi stream the **bot** dials
-  on the gateway (`Hello` / `Command` / `Ack`), now also carrying a `ChatGateCommand` (set
-  a user's chat write access) and a unary `ResolveChatEligibility` (the bot's join-time
-  query) over the same mTLS channel. Generated Go is committed under `pkg`.
+  on the gateway (`Hello` / `Command` / `Ack`), carrying a `ChatGateCommand` (set a user's
+  chat write access) and a `CreateInvoiceCommand` (mint a Stars invoice link, returned in the
+  Ack result), plus unary `ResolveChatEligibility` (the bot's join-time query),
+  `ValidatePreCheckout` and `ForwardPayment` (the Stars rail) over the same mTLS channel.
+  Generated Go is committed under `pkg`.
 
 ## Deep-link scheme
 
@@ -153,6 +165,7 @@ Bot (`cmd/bot`):
 | `TELEGRAM_CHAT_ID` | — | the moderated discussion chat id (a channel's linked group); empty disables chat gating |
 | `TELEGRAM_SUPPORT_CHAT_ID` | — | the support relay's forum supergroup id (topic per user); empty disables the relay |
 | `TELEGRAM_SUPPORT_STATE_DIR` | `/data` | directory for the support relay's JSON state (a writable volume) |
+| `TELEGRAM_STARS_OUTBOX_DIR` | `/data` | directory for the Telegram Stars payment outbox (`stars.db`, a writable volume); empty disables the Stars rail |
 | `TELEGRAM_PROMO_BOT_TOKEN` | — | the optional standalone promo bot's token; empty disables it |
 | `TELEGRAM_BOT_USERNAME` | — | the main bot's @username without the @ (promo message); required when the promo bot runs |
 | `TELEGRAM_BOT_LINK` | — | the main bot's Mini App link for the promo button (the UI's `VITE_TELEGRAM_LINK`); required when the promo bot runs |