feat(payments): trusted platform signal on the session

Record the execution platform (kind vk|telegram|direct + device subtype
ios|android|web) on each session, captured at creation and carried
gateway->backend as a trusted X-Platform header, so the upcoming
store-compliance gate has an unforgeable execution context.

- backend.sessions gains nullable platform_kind/platform_subtype columns
  (migration 00011, CHECK-constrained, jet regenerated); session.Platform
  captures them at mint, resolve returns them, middleware exposes platform(c).
  kind is derived from the establish endpoint, never a client field; the
  account-merge session mint inherits the caller's platform.
- gateway derives the platform (VK subtype from the signed vk_platform via
  vkauth, Telegram/direct best-effort from the client) and injects X-Platform
  on every authenticated backend call through the request context.
- ui submits a best-effort device subtype on the telegram/guest/email login
  requests (new FBS subtype field); VK is server-derived from the signed params.
- an unattributed session is untrusted (view-only); VK/TG self-heal on the next
  cold-start re-mint, direct/email on re-login.

Signal plumbing only, no user-visible change; X-Platform is inert until the
gate consumes it.

ui/src/lib/codec.ts

@@ -182,13 +182,19 @@ export function encodeChatPost(gameId: string, body: string): Uint8Array {
   return finish(b, fb.ChatPostRequest.endChatPostRequest(b));
 }
 
-export function encodeTelegramLogin(initData: string, browserTz: string): Uint8Array {
+export function encodeTelegramLogin(
+  initData: string,
+  browserTz: string,
+  subtype: string,
+): Uint8Array {
   const b = new Builder(512);
   const d = b.createString(initData);
   const tz = b.createString(browserTz);
+  const st = b.createString(subtype);
   fb.TelegramLoginRequest.startTelegramLoginRequest(b);
   fb.TelegramLoginRequest.addInitData(b, d);
   fb.TelegramLoginRequest.addBrowserTz(b, tz);
+  fb.TelegramLoginRequest.addSubtype(b, st);
   return finish(b, fb.TelegramLoginRequest.endTelegramLoginRequest(b));
 }
 
@@ -204,13 +210,19 @@ export function encodeVKLogin(params: string, browserTz: string, displayName: st
   return finish(b, fb.VKLoginRequest.endVKLoginRequest(b));
 }
 
-export function encodeGuestLogin(locale: string, browserTz: string): Uint8Array {
+export function encodeGuestLogin(
+  locale: string,
+  browserTz: string,
+  subtype: string,
+): Uint8Array {
   const b = new Builder(64);
   const l = b.createString(locale);
   const tz = b.createString(browserTz);
+  const st = b.createString(subtype);
   fb.GuestLoginRequest.startGuestLoginRequest(b);
   fb.GuestLoginRequest.addLocale(b, l);
   fb.GuestLoginRequest.addBrowserTz(b, tz);
+  fb.GuestLoginRequest.addSubtype(b, st);
   return finish(b, fb.GuestLoginRequest.endGuestLoginRequest(b));
 }
 
@@ -232,13 +244,15 @@ export function encodeEmailRequest(
   return finish(b, fb.EmailRequestRequest.endEmailRequestRequest(b));
 }
 
-export function encodeEmailLogin(email: string, code: string): Uint8Array {
+export function encodeEmailLogin(email: string, code: string, subtype: string): Uint8Array {
   const b = new Builder(128);
   const e = b.createString(email);
   const c = b.createString(code);
+  const st = b.createString(subtype);
   fb.EmailLoginRequest.startEmailLoginRequest(b);
   fb.EmailLoginRequest.addEmail(b, e);
   fb.EmailLoginRequest.addCode(b, c);
+  fb.EmailLoginRequest.addSubtype(b, st);
   return finish(b, fb.EmailLoginRequest.endEmailLoginRequest(b));
 }