feat(payments): trusted platform signal on the session

Record the execution platform (kind vk|telegram|direct + device subtype
ios|android|web) on each session, captured at creation and carried
gateway->backend as a trusted X-Platform header, so the upcoming
store-compliance gate has an unforgeable execution context.

- backend.sessions gains nullable platform_kind/platform_subtype columns
  (migration 00011, CHECK-constrained, jet regenerated); session.Platform
  captures them at mint, resolve returns them, middleware exposes platform(c).
  kind is derived from the establish endpoint, never a client field; the
  account-merge session mint inherits the caller's platform.
- gateway derives the platform (VK subtype from the signed vk_platform via
  vkauth, Telegram/direct best-effort from the client) and injects X-Platform
  on every authenticated backend call through the request context.
- ui submits a best-effort device subtype on the telegram/guest/email login
  requests (new FBS subtype field); VK is server-derived from the signed params.
- an unattributed session is untrusted (view-only); VK/TG self-heal on the next
  cold-start re-mint, direct/email on re-login.

Signal plumbing only, no user-visible change; X-Platform is inert until the
gate consumes it.

ui/src/lib/platform.ts

@@ -0,0 +1,30 @@
+// Platform subtype (device family) derivation for the trusted platform signal. The
+// server records the wrapper kind (vk / telegram / direct) itself, from the validated
+// establish path; the client supplies only this device subtype. For VK it is ignored
+// server-side (the gateway derives a trusted subtype from the signed vk_platform); for
+// Telegram and a direct (web/native) session it is client-reported and best-effort.
+
+import { insideTelegram, telegramPlatform } from './telegram';
+import { clientChannel } from './channel';
+
+export type Subtype = 'ios' | 'android' | 'web';
+
+// normalizeSubtype coerces a raw device string (Telegram's WebApp.platform, a
+// Capacitor platform, VK's vk_platform, …) to the ios/android/web wire subtype,
+// mapping any iPhone/iPad variant to ios and defaulting anything unrecognised —
+// desktop, tdesktop, an empty value — to web.
+export function normalizeSubtype(raw: string): Subtype {
+  const s = raw.toLowerCase();
+  if (s.includes('android')) return 'android';
+  if (s.includes('iphone') || s.includes('ipad') || s === 'ios') return 'ios';
+  return 'web';
+}
+
+// platformSubtype reports this client's best-effort device family for the current
+// launch: Telegram's reported platform inside a Mini App, otherwise the Capacitor /
+// web channel for a direct session. VK does not use it (server-derived from the signed
+// launch params).
+export function platformSubtype(): Subtype {
+  if (insideTelegram()) return normalizeSubtype(telegramPlatform());
+  return normalizeSubtype(clientChannel());
+}