Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

gateway/internal/connector/routing_test.go

@@ -0,0 +1,38 @@
+package connector
+
+import "testing"
+
+func TestOutOfAppKind(t *testing.T) {
+	out := []string{"your_turn", "nudge", "match_found", "notify"}
+	for _, k := range out {
+		if !OutOfAppKind(k) {
+			t.Errorf("OutOfAppKind(%q) = false, want true", k)
+		}
+	}
+	for _, k := range []string{"opponent_moved", "chat_message", "", "unknown"} {
+		if OutOfAppKind(k) {
+			t.Errorf("OutOfAppKind(%q) = true, want false", k)
+		}
+	}
+}
+
+func TestDeliverToTarget(t *testing.T) {
+	cases := []struct {
+		name       string
+		externalID string
+		inAppOnly  bool
+		want       bool
+	}{
+		{"telegram + opted in", "12345", false, true},
+		{"in-app only suppresses", "12345", true, false},
+		{"no telegram identity", "", false, false},
+		{"no identity and in-app only", "", true, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := DeliverToTarget(tc.externalID, tc.inAppOnly); got != tc.want {
+				t.Errorf("DeliverToTarget(%q, %v) = %v, want %v", tc.externalID, tc.inAppOnly, got, tc.want)
+			}
+		})
+	}
+}