feat(payments): trusted platform signal on the session

Record the execution platform (kind vk|telegram|direct + device subtype
ios|android|web) on each session, captured at creation and carried
gateway->backend as a trusted X-Platform header, so the upcoming
store-compliance gate has an unforgeable execution context.

- backend.sessions gains nullable platform_kind/platform_subtype columns
  (migration 00011, CHECK-constrained, jet regenerated); session.Platform
  captures them at mint, resolve returns them, middleware exposes platform(c).
  kind is derived from the establish endpoint, never a client field; the
  account-merge session mint inherits the caller's platform.
- gateway derives the platform (VK subtype from the signed vk_platform via
  vkauth, Telegram/direct best-effort from the client) and injects X-Platform
  on every authenticated backend call through the request context.
- ui submits a best-effort device subtype on the telegram/guest/email login
  requests (new FBS subtype field); VK is server-derived from the signed params.
- an unattributed session is untrusted (view-only); VK/TG self-heal on the next
  cold-start re-mint, direct/email on re-login.

Signal plumbing only, no user-visible change; X-Platform is inert until the
gate consumes it.

ui/src/lib/platform.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest';
+import { normalizeSubtype } from './platform';
+
+describe('normalizeSubtype', () => {
+  it('maps iPhone and iPad variants to the store-frozen ios', () => {
+    expect(normalizeSubtype('ios')).toBe('ios');
+    expect(normalizeSubtype('iphone')).toBe('ios');
+    expect(normalizeSubtype('mobile_iphone')).toBe('ios');
+    expect(normalizeSubtype('mobile_ipad')).toBe('ios');
+  });
+
+  it('maps android variants to android', () => {
+    expect(normalizeSubtype('android')).toBe('android');
+    expect(normalizeSubtype('mobile_android')).toBe('android');
+    expect(normalizeSubtype('android_x')).toBe('android');
+  });
+
+  it('is case-insensitive', () => {
+    expect(normalizeSubtype('IPhone')).toBe('ios');
+    expect(normalizeSubtype('Android')).toBe('android');
+  });
+
+  it('defaults desktop, tdesktop, web, empty and unknown values to web', () => {
+    expect(normalizeSubtype('web')).toBe('web');
+    expect(normalizeSubtype('mobile_web')).toBe('web');
+    expect(normalizeSubtype('desktop_web')).toBe('web');
+    expect(normalizeSubtype('tdesktop')).toBe('web');
+    expect(normalizeSubtype('')).toBe('web');
+    expect(normalizeSubtype('something_new')).toBe('web');
+  });
+});