feat(payments): Telegram Stars payment rail

Accept real money via Telegram Stars (XTR) — the third intake rail
alongside Robokassa (direct) and VK Votes.

Only the bot reaches Telegram, so the rail funnels through the reverse
mTLS bot-link:
- the gateway mints the invoice on a CreateInvoice command (the bot
  calls createInvoiceLink, XTR; the link goes to WebApp.openInvoice);
- the bot gates each pre_checkout_query via a ValidatePreCheckout unary
  (the order must exist, be still creditable and not already paid — the
  reusable-invoice double-pay guard; the decline reason is localised to
  the order account's language);
- a completed successful_payment is queued in a durable pure-Go SQLite
  outbox and forwarded via a ForwardPayment unary, credited once
  (idempotent on telegram_payment_charge_id, honours an expired order),
  re-driven on restart and every 30s.

The rail is wired by TELEGRAM_STARS_OUTBOX_DIR (default /data) but stays
inert until a chip pack carries an XTR price, so seeding a Stars price in
the admin is the go-live.

Tests: backend integration (order->forward->credit once, duplicate,
pre_checkout gate) + bot outbox unit (idempotent, restart re-drive) +
executor createInvoice. Docs: PAYMENTS(+ru) §9, ARCHITECTURE, the
platform/telegram README, PLAN.

platform/telegram/cmd/bot/main.go

@@ -23,6 +23,7 @@ import (
 	"scrabble/platform/telegram/internal/bot"
 	"scrabble/platform/telegram/internal/botlink"
 	"scrabble/platform/telegram/internal/config"
+	"scrabble/platform/telegram/internal/outbox"
 	"scrabble/platform/telegram/internal/promobot"
 	"scrabble/platform/telegram/internal/support"
 )
@@ -90,11 +91,24 @@ func run(ctx context.Context, cfg config.BotConfig, logger *zap.Logger) error {
 		GameChannelID:     cfg.GameChannelID,
 		SupportChatID:     cfg.SupportChatID,
 		SupportStore:      supportStore,
+		AcceptPayments:    cfg.StarsOutboxDir != "",
 	}, logger)
 	if err != nil {
 		return err
 	}
 
+	// The Telegram Stars payment outbox: a durable SQLite store on the bot host's writable volume.
+	// Opened when the rail is enabled; a failure to open is fatal, since accepting Stars without a
+	// durable outbox would risk losing a paid-for order.
+	var paymentOutbox *outbox.Store
+	if cfg.StarsOutboxDir != "" {
+		paymentOutbox, err = outbox.Open(filepath.Join(cfg.StarsOutboxDir, "stars.db"))
+		if err != nil {
+			return err
+		}
+		defer func() { _ = paymentOutbox.Close() }()
+	}
+
 	tlsCfg, err := mtls.ClientConfig(cfg.BotLink.CertFile, cfg.BotLink.KeyFile, cfg.BotLink.CAFile, cfg.BotLink.ServerName)
 	if err != nil {
 		return err
@@ -115,6 +129,12 @@ func run(ctx context.Context, cfg config.BotConfig, logger *zap.Logger) error {
 	// the bot after the client is built — the late binding that breaks the bot <->
 	// client construction cycle.
 	b.SetEligibilityResolver(client.ResolveChatEligibility)
+	// The Telegram Stars payment path rides the same bot-link: pre_checkout validation and
+	// completed-payment forwarding, backed by the durable outbox — wired here for the same
+	// late-binding reason.
+	if paymentOutbox != nil {
+		b.SetPaymentHandlers(client.ValidatePreCheckout, client.ForwardPayment, paymentOutbox)
+	}
 
 	// The optional standalone promo bot: a second bot (its own token) that only answers
 	// /start with a button opening the main bot's Mini App. It is self-contained — no
@@ -160,6 +180,11 @@ func run(ctx context.Context, cfg config.BotConfig, logger *zap.Logger) error {
 			logger.Error("bot-link client stopped", zap.Error(err))
 		}
 	})
+	// Re-drive the Stars payment outbox: at startup (recovering payments left by a restart or a past
+	// outage) and periodically thereafter.
+	if paymentOutbox != nil {
+		wg.Go(func() { b.RunPaymentDrainer(ctx) })
+	}
 	// The promo bot runs its own getUpdates long-poll on its own token (no 409 with
 	// the main bot's lease).
 	if promo != nil {