feat(payments): trusted platform signal on the session

Record the execution platform (kind vk|telegram|direct + device subtype
ios|android|web) on each session, captured at creation and carried
gateway->backend as a trusted X-Platform header, so the upcoming
store-compliance gate has an unforgeable execution context.

- backend.sessions gains nullable platform_kind/platform_subtype columns
  (migration 00011, CHECK-constrained, jet regenerated); session.Platform
  captures them at mint, resolve returns them, middleware exposes platform(c).
  kind is derived from the establish endpoint, never a client field; the
  account-merge session mint inherits the caller's platform.
- gateway derives the platform (VK subtype from the signed vk_platform via
  vkauth, Telegram/direct best-effort from the client) and injects X-Platform
  on every authenticated backend call through the request context.
- ui submits a best-effort device subtype on the telegram/guest/email login
  requests (new FBS subtype field); VK is server-derived from the signed params.
- an unattributed session is untrusted (view-only); VK/TG self-heal on the next
  cold-start re-mint, direct/email on re-login.

Signal plumbing only, no user-visible change; X-Platform is inert until the
gate consumes it.

gateway/internal/session/cache_test.go

@@ -8,18 +8,19 @@ import (
 )
 
 type fakeResolver struct {
-	uid   string
-	guest bool
-	err   error
-	calls int
+	uid      string
+	guest    bool
+	platform string
+	err      error
+	calls    int
 }
 
-func (f *fakeResolver) ResolveSession(_ context.Context, _ string) (string, bool, error) {
+func (f *fakeResolver) ResolveSession(_ context.Context, _ string) (string, bool, string, error) {
 	f.calls++
 	if f.err != nil {
-		return "", false, f.err
+		return "", false, "", f.err
 	}
-	return f.uid, f.guest, nil
+	return f.uid, f.guest, f.platform, nil
 }
 
 func TestResolveCachesBackendHit(t *testing.T) {
@@ -27,7 +28,7 @@ func TestResolveCachesBackendHit(t *testing.T) {
 	c := NewCache(r, time.Minute, 10)
 
 	for i := 0; i < 3; i++ {
-		uid, _, err := c.Resolve(context.Background(), "tok")
+		uid, _, _, err := c.Resolve(context.Background(), "tok")
 		if err != nil || uid != "user-1" {
 			t.Fatalf("resolve #%d = (%q, %v)", i, uid, err)
 		}
@@ -37,24 +38,24 @@ func TestResolveCachesBackendHit(t *testing.T) {
 	}
 }
 
-func TestResolveCarriesAndCachesGuestFlag(t *testing.T) {
-	r := &fakeResolver{uid: "guest-1", guest: true}
+func TestResolveCarriesAndCachesGuestFlagAndPlatform(t *testing.T) {
+	r := &fakeResolver{uid: "guest-1", guest: true, platform: "vk/ios"}
 	c := NewCache(r, time.Minute, 10)
 	for i := 0; i < 2; i++ {
-		uid, guest, err := c.Resolve(context.Background(), "tok")
-		if err != nil || uid != "guest-1" || !guest {
-			t.Fatalf("resolve #%d = (%q, guest=%v, %v)", i, uid, guest, err)
+		uid, guest, platform, err := c.Resolve(context.Background(), "tok")
+		if err != nil || uid != "guest-1" || !guest || platform != "vk/ios" {
+			t.Fatalf("resolve #%d = (%q, guest=%v, platform=%q, %v)", i, uid, guest, platform, err)
 		}
 	}
 	if r.calls != 1 {
-		t.Fatalf("backend calls = %d, want 1 (guest flag cached)", r.calls)
+		t.Fatalf("backend calls = %d, want 1 (guest flag + platform cached)", r.calls)
 	}
 }
 
 func TestResolvePropagatesBackendError(t *testing.T) {
 	r := &fakeResolver{err: errors.New("nope")}
 	c := NewCache(r, time.Minute, 10)
-	if _, _, err := c.Resolve(context.Background(), "tok"); err == nil {
+	if _, _, _, err := c.Resolve(context.Background(), "tok"); err == nil {
 		t.Fatal("expected backend error to propagate")
 	}
 }
@@ -65,11 +66,11 @@ func TestResolveReResolvesAfterTTL(t *testing.T) {
 	base := time.Now()
 	c.now = func() time.Time { return base }
 
-	if _, _, err := c.Resolve(context.Background(), "tok"); err != nil {
+	if _, _, _, err := c.Resolve(context.Background(), "tok"); err != nil {
 		t.Fatal(err)
 	}
 	c.now = func() time.Time { return base.Add(2 * time.Minute) } // past TTL
-	if _, _, err := c.Resolve(context.Background(), "tok"); err != nil {
+	if _, _, _, err := c.Resolve(context.Background(), "tok"); err != nil {
 		t.Fatal(err)
 	}
 	if r.calls != 2 {
@@ -80,9 +81,9 @@ func TestResolveReResolvesAfterTTL(t *testing.T) {
 func TestInvalidateForcesReResolve(t *testing.T) {
 	r := &fakeResolver{uid: "user-1"}
 	c := NewCache(r, time.Minute, 10)
-	_, _, _ = c.Resolve(context.Background(), "tok")
+	_, _, _, _ = c.Resolve(context.Background(), "tok")
 	c.Invalidate("tok")
-	_, _, _ = c.Resolve(context.Background(), "tok")
+	_, _, _, _ = c.Resolve(context.Background(), "tok")
 	if r.calls != 2 {
 		t.Fatalf("backend calls = %d, want 2 after invalidate", r.calls)
 	}