feat(payments): trusted platform signal on the session

Record the execution platform (kind vk|telegram|direct + device subtype
ios|android|web) on each session, captured at creation and carried
gateway->backend as a trusted X-Platform header, so the upcoming
store-compliance gate has an unforgeable execution context.

- backend.sessions gains nullable platform_kind/platform_subtype columns
  (migration 00011, CHECK-constrained, jet regenerated); session.Platform
  captures them at mint, resolve returns them, middleware exposes platform(c).
  kind is derived from the establish endpoint, never a client field; the
  account-merge session mint inherits the caller's platform.
- gateway derives the platform (VK subtype from the signed vk_platform via
  vkauth, Telegram/direct best-effort from the client) and injects X-Platform
  on every authenticated backend call through the request context.
- ui submits a best-effort device subtype on the telegram/guest/email login
  requests (new FBS subtype field); VK is server-derived from the signed params.
- an unattributed session is untrusted (view-only); VK/TG self-heal on the next
  cold-start re-mint, direct/email on re-login.

Signal plumbing only, no user-visible change; X-Platform is inert until the
gate consumes it.

ui/src/gen/fbs/scrabblefb/email-login-request.ts

@@ -34,8 +34,15 @@ code(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+subtype():string|null
+subtype(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+subtype(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startEmailLoginRequest(builder:flatbuffers.Builder) {
-  builder.startObject(2);
+  builder.startObject(3);
 }
 
 static addEmail(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset) {
@@ -46,15 +53,20 @@ static addCode(builder:flatbuffers.Builder, codeOffset:flatbuffers.Offset) {
   builder.addFieldOffset(1, codeOffset, 0);
 }
 
+static addSubtype(builder:flatbuffers.Builder, subtypeOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(2, subtypeOffset, 0);
+}
+
 static endEmailLoginRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createEmailLoginRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset, codeOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createEmailLoginRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset, codeOffset:flatbuffers.Offset, subtypeOffset:flatbuffers.Offset):flatbuffers.Offset {
   EmailLoginRequest.startEmailLoginRequest(builder);
   EmailLoginRequest.addEmail(builder, emailOffset);
   EmailLoginRequest.addCode(builder, codeOffset);
+  EmailLoginRequest.addSubtype(builder, subtypeOffset);
   return EmailLoginRequest.endEmailLoginRequest(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/guest-login-request.ts

@@ -34,8 +34,15 @@ browserTz(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+subtype():string|null
+subtype(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+subtype(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startGuestLoginRequest(builder:flatbuffers.Builder) {
-  builder.startObject(2);
+  builder.startObject(3);
 }
 
 static addLocale(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset) {
@@ -46,15 +53,20 @@ static addBrowserTz(builder:flatbuffers.Builder, browserTzOffset:flatbuffers.Off
   builder.addFieldOffset(1, browserTzOffset, 0);
 }
 
+static addSubtype(builder:flatbuffers.Builder, subtypeOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(2, subtypeOffset, 0);
+}
+
 static endGuestLoginRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createGuestLoginRequest(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createGuestLoginRequest(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset, subtypeOffset:flatbuffers.Offset):flatbuffers.Offset {
   GuestLoginRequest.startGuestLoginRequest(builder);
   GuestLoginRequest.addLocale(builder, localeOffset);
   GuestLoginRequest.addBrowserTz(builder, browserTzOffset);
+  GuestLoginRequest.addSubtype(builder, subtypeOffset);
   return GuestLoginRequest.endGuestLoginRequest(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/telegram-login-request.ts

@@ -34,8 +34,15 @@ browserTz(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+subtype():string|null
+subtype(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+subtype(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startTelegramLoginRequest(builder:flatbuffers.Builder) {
-  builder.startObject(2);
+  builder.startObject(3);
 }
 
 static addInitData(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset) {
@@ -46,15 +53,20 @@ static addBrowserTz(builder:flatbuffers.Builder, browserTzOffset:flatbuffers.Off
   builder.addFieldOffset(1, browserTzOffset, 0);
 }
 
+static addSubtype(builder:flatbuffers.Builder, subtypeOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(2, subtypeOffset, 0);
+}
+
 static endTelegramLoginRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createTelegramLoginRequest(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createTelegramLoginRequest(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset, subtypeOffset:flatbuffers.Offset):flatbuffers.Offset {
   TelegramLoginRequest.startTelegramLoginRequest(builder);
   TelegramLoginRequest.addInitData(builder, initDataOffset);
   TelegramLoginRequest.addBrowserTz(builder, browserTzOffset);
+  TelegramLoginRequest.addSubtype(builder, subtypeOffset);
   return TelegramLoginRequest.endTelegramLoginRequest(builder);
 }
 }