feat(payments): trusted platform signal on the session

Record the execution platform (kind vk|telegram|direct + device subtype
ios|android|web) on each session, captured at creation and carried
gateway->backend as a trusted X-Platform header, so the upcoming
store-compliance gate has an unforgeable execution context.

- backend.sessions gains nullable platform_kind/platform_subtype columns
  (migration 00011, CHECK-constrained, jet regenerated); session.Platform
  captures them at mint, resolve returns them, middleware exposes platform(c).
  kind is derived from the establish endpoint, never a client field; the
  account-merge session mint inherits the caller's platform.
- gateway derives the platform (VK subtype from the signed vk_platform via
  vkauth, Telegram/direct best-effort from the client) and injects X-Platform
  on every authenticated backend call through the request context.
- ui submits a best-effort device subtype on the telegram/guest/email login
  requests (new FBS subtype field); VK is server-derived from the signed params.
- an unattributed session is untrusted (view-only); VK/TG self-heal on the next
  cold-start re-mint, direct/email on re-login.

Signal plumbing only, no user-visible change; X-Platform is inert until the
gate consumes it.

gateway/internal/backendclient/client.go

@@ -118,8 +118,30 @@ func (e *APIError) Error() string {
 	return fmt.Sprintf("backend %d (%s): %s", e.Status, e.Code, e.Message)
 }
 
+// platformCtxKey types the request-context slot the trusted X-Platform value rides in.
+type platformCtxKey struct{}
+
+// WithPlatform returns a copy of ctx carrying the trusted platform header value
+// ("<kind>/<subtype>", e.g. "vk/ios") that do and getRaw inject as X-Platform on the
+// outbound backend request. An empty platform (an untrusted session) leaves ctx
+// unchanged, so no header is sent and the backend treats the request as untrusted.
+func WithPlatform(ctx context.Context, platform string) context.Context {
+	if platform == "" {
+		return ctx
+	}
+	return context.WithValue(ctx, platformCtxKey{}, platform)
+}
+
+// platformFromContext returns the platform header value stored by WithPlatform, or
+// an empty string when none is present.
+func platformFromContext(ctx context.Context) string {
+	p, _ := ctx.Value(platformCtxKey{}).(string)
+	return p
+}
+
 // do performs one REST call. userID, when non-empty, is forwarded as X-User-ID;
-// clientIP, when non-empty, as X-Forwarded-For (for chat moderation). A non-2xx
+// clientIP, when non-empty, as X-Forwarded-For (for chat moderation); the trusted
+// platform carried on ctx (see WithPlatform), when present, as X-Platform. A non-2xx
 // response is returned as an *APIError carrying the backend error code.
 func (c *Client) do(ctx context.Context, method, path, userID, clientIP string, body, out any) error {
 	var reader io.Reader
@@ -141,6 +163,9 @@ func (c *Client) do(ctx context.Context, method, path, userID, clientIP string,
 	if clientIP != "" {
 		req.Header.Set("X-Forwarded-For", clientIP)
 	}
+	if p := platformFromContext(ctx); p != "" {
+		req.Header.Set("X-Platform", p)
+	}
 	resp, err := c.http.Do(req)
 	if err != nil {
 		return fmt.Errorf("backendclient: %s %s: %w", method, path, err)
@@ -174,6 +199,9 @@ func (c *Client) getRaw(ctx context.Context, path, userID, respHeader string) ([
 	if userID != "" {
 		req.Header.Set("X-User-ID", userID)
 	}
+	if p := platformFromContext(ctx); p != "" {
+		req.Header.Set("X-Platform", p)
+	}
 	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, "", fmt.Errorf("backendclient: GET %s: %w", path, err)