feat(payments): Telegram Stars payment rail

Accept real money via Telegram Stars (XTR) — the third intake rail
alongside Robokassa (direct) and VK Votes.

Only the bot reaches Telegram, so the rail funnels through the reverse
mTLS bot-link:
- the gateway mints the invoice on a CreateInvoice command (the bot
  calls createInvoiceLink, XTR; the link goes to WebApp.openInvoice);
- the bot gates each pre_checkout_query via a ValidatePreCheckout unary
  (the order must exist, be still creditable and not already paid — the
  reusable-invoice double-pay guard; the decline reason is localised to
  the order account's language);
- a completed successful_payment is queued in a durable pure-Go SQLite
  outbox and forwarded via a ForwardPayment unary, credited once
  (idempotent on telegram_payment_charge_id, honours an expired order),
  re-driven on restart and every 30s.

The rail is wired by TELEGRAM_STARS_OUTBOX_DIR (default /data) but stays
inert until a chip pack carries an XTR price, so seeding a Stars price in
the admin is the go-live.

Tests: backend integration (order->forward->credit once, duplicate,
pre_checkout gate) + bot outbox unit (idempotent, restart re-drive) +
executor createInvoice. Docs: PAYMENTS(+ru) §9, ARCHITECTURE, the
platform/telegram README, PLAN.

platform/telegram/internal/outbox/store_test.go

@@ -0,0 +1,124 @@
+package outbox
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+)
+
+// openTemp opens a fresh outbox in a temp dir.
+func openTemp(t *testing.T) *Store {
+	t.Helper()
+	s, err := Open(filepath.Join(t.TempDir(), "stars.db"))
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	t.Cleanup(func() { _ = s.Close() })
+	return s
+}
+
+func TestOutboxAddPendingMark(t *testing.T) {
+	ctx := context.Background()
+	s := openTemp(t)
+
+	rec := Record{ChargeID: "ch1", OrderID: "ord1", Amount: 40, UserID: 777}
+	if err := s.Add(ctx, rec); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+	pending, err := s.Pending(ctx, 10)
+	if err != nil {
+		t.Fatalf("pending: %v", err)
+	}
+	if len(pending) != 1 || pending[0] != rec {
+		t.Fatalf("pending = %+v, want [%+v]", pending, rec)
+	}
+
+	if err := s.MarkForwarded(ctx, "ch1"); err != nil {
+		t.Fatalf("mark: %v", err)
+	}
+	pending, err = s.Pending(ctx, 10)
+	if err != nil {
+		t.Fatalf("pending after mark: %v", err)
+	}
+	if len(pending) != 0 {
+		t.Fatalf("pending after mark = %+v, want empty", pending)
+	}
+}
+
+func TestOutboxAddIdempotent(t *testing.T) {
+	ctx := context.Background()
+	s := openTemp(t)
+
+	rec := Record{ChargeID: "dup", OrderID: "ord1", Amount: 80, UserID: 1}
+	if err := s.Add(ctx, rec); err != nil {
+		t.Fatalf("add 1: %v", err)
+	}
+	// A re-delivered payment (same charge id) must not add a second row, even with different fields.
+	if err := s.Add(ctx, Record{ChargeID: "dup", OrderID: "other", Amount: 999, UserID: 2}); err != nil {
+		t.Fatalf("add 2: %v", err)
+	}
+	pending, err := s.Pending(ctx, 10)
+	if err != nil {
+		t.Fatalf("pending: %v", err)
+	}
+	if len(pending) != 1 || pending[0] != rec {
+		t.Fatalf("pending = %+v, want the single original row", pending)
+	}
+}
+
+func TestOutboxAddIgnoresForwarded(t *testing.T) {
+	ctx := context.Background()
+	s := openTemp(t)
+
+	rec := Record{ChargeID: "ch", OrderID: "o", Amount: 40, UserID: 5}
+	if err := s.Add(ctx, rec); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+	if err := s.MarkForwarded(ctx, "ch"); err != nil {
+		t.Fatalf("mark: %v", err)
+	}
+	// A re-delivery after forwarding must not resurrect the row as pending (no double credit).
+	if err := s.Add(ctx, rec); err != nil {
+		t.Fatalf("re-add: %v", err)
+	}
+	pending, err := s.Pending(ctx, 10)
+	if err != nil {
+		t.Fatalf("pending: %v", err)
+	}
+	if len(pending) != 0 {
+		t.Fatalf("pending = %+v, want empty (already forwarded)", pending)
+	}
+}
+
+// TestOutboxReopenReDrives proves a restart re-drives undelivered payments: a payment persisted but
+// not marked forwarded is still pending after the store is reopened from the same file.
+func TestOutboxReopenReDrives(t *testing.T) {
+	ctx := context.Background()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "stars.db")
+
+	s, err := Open(path)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	rec := Record{ChargeID: "persist", OrderID: "o1", Amount: 40, UserID: 9}
+	if err := s.Add(ctx, rec); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+	if err := s.Close(); err != nil {
+		t.Fatalf("close: %v", err)
+	}
+
+	reopened, err := Open(path)
+	if err != nil {
+		t.Fatalf("reopen: %v", err)
+	}
+	defer func() { _ = reopened.Close() }()
+	pending, err := reopened.Pending(ctx, 10)
+	if err != nil {
+		t.Fatalf("pending: %v", err)
+	}
+	if len(pending) != 1 || pending[0] != rec {
+		t.Fatalf("pending after reopen = %+v, want the undelivered payment", pending)
+	}
+}