feat(payments): Telegram Stars payment rail

Accept real money via Telegram Stars (XTR) — the third intake rail
alongside Robokassa (direct) and VK Votes.

Only the bot reaches Telegram, so the rail funnels through the reverse
mTLS bot-link:
- the gateway mints the invoice on a CreateInvoice command (the bot
  calls createInvoiceLink, XTR; the link goes to WebApp.openInvoice);
- the bot gates each pre_checkout_query via a ValidatePreCheckout unary
  (the order must exist, be still creditable and not already paid — the
  reusable-invoice double-pay guard; the decline reason is localised to
  the order account's language);
- a completed successful_payment is queued in a durable pure-Go SQLite
  outbox and forwarded via a ForwardPayment unary, credited once
  (idempotent on telegram_payment_charge_id, honours an expired order),
  re-driven on restart and every 30s.

The rail is wired by TELEGRAM_STARS_OUTBOX_DIR (default /data) but stays
inert until a chip pack carries an XTR price, so seeding a Stars price in
the admin is the go-live.

Tests: backend integration (order->forward->credit once, duplicate,
pre_checkout gate) + bot outbox unit (idempotent, restart re-drive) +
executor createInvoice. Docs: PAYMENTS(+ru) §9, ARCHITECTURE, the
platform/telegram README, PLAN.

ui/src/lib/telegram.ts

@@ -39,6 +39,7 @@ interface TelegramWebApp {
   close?: () => void;
   openTelegramLink?: (url: string) => void;
   openLink?: (url: string) => void;
+  openInvoice?: (url: string, callback?: (status: string) => void) => void;
   onEvent?: (event: string, handler: () => void) => void;
   setHeaderColor?: (color: string) => void;
   setBackgroundColor?: (color: string) => void;
@@ -170,6 +171,20 @@ export function telegramOpenLink(url: string): boolean {
   return true;
 }
 
+/**
+ * telegramOpenInvoice opens a Telegram Stars invoice inside the Mini App (WebApp.openInvoice) and
+ * calls onStatus with the outcome ('paid' | 'cancelled' | 'failed' | 'pending'). Returns false
+ * outside Telegram or when the SDK lacks the method. The invoice url is the createInvoiceLink the
+ * bot minted for the order; the chips are credited server-side by the forwarded payment, so 'paid'
+ * only signals to refresh the wallet — the live push is the authoritative update.
+ */
+export function telegramOpenInvoice(url: string, onStatus?: (status: string) => void): boolean {
+  const w = webApp();
+  if (!w?.openInvoice) return false;
+  w.openInvoice(url, onStatus);
+  return true;
+}
+
 /**
  * telegramOpenExternalLink opens an arbitrary external URL through the Mini App SDK's openLink,
  * so Telegram opens it directly in its in-app browser instead of the WebView's generic "open

ui/src/screens/Wallet.svelte

@@ -9,6 +9,7 @@
   import { isGooglePlayBuild } from '../lib/distribution';
   import { onExternalLinkClick, openExternalUrl } from '../lib/links';
   import { vkPlatform, vkShowOrderBox } from '../lib/vk';
+  import { telegramOpenInvoice } from '../lib/telegram';
   import type { Wallet, Catalog, CatalogProduct } from '../lib/model';
 
   // The Wallet section: the context-visible chip balances, the active benefits, and the storefront.
@@ -119,6 +120,14 @@
       if (context === 'vk') {
         // VK settles the payment in-app via the bridge; the chips arrive on the server callback.
         await vkShowOrderBox(order.orderId);
+      } else if (context === 'telegram') {
+        // Telegram Stars: the bot minted an invoice link (returned as redirectUrl); open it in-app.
+        // The chips are credited server-side by the forwarded payment and arrive on the live push;
+        // refresh on 'paid' as a fallback. Outside a Stars-capable client, fall back to the link.
+        const opened = telegramOpenInvoice(order.redirectUrl, (status) => {
+          if (status === 'paid') void load();
+        });
+        if (!opened) openExternalUrl(order.redirectUrl);
       } else {
         openExternalUrl(order.redirectUrl);
       }