feat(vk): show a launch diagnostic on a direct /vk/ open instead of a guest

Opening the dedicated /vk/ entry directly in an ordinary browser (no signed VK
launch) fell through to the web flow and silently started a throwaway guest,
which is wrong for a VK-only entry. Mirror the existing /telegram/ launch-error
behaviour: render a compact, shareable, privacy-safe diagnostic screen instead.

- Boot: a new branch `onVKPath() && !insideVK()` sets app.launchError and stops
  the fall-through, the VK counterpart of the /telegram/ diagnostic guard.
- Diagnostic (passive, no VK Bridge round-trip): reads the URL launch-parameter
  NAMES (never the `sign` value — auth material), whether the URL was signed,
  `vk_platform`, the iframe/referrer context, plus the shared client-environment
  lines. VK signs the launch URL at load, so — unlike Telegram's initData — the
  parameters never arrive late; hence the VK screen offers Share only, no Retry.
- Generalise the screen: TelegramLaunchError.svelte -> LaunchError.svelte, which
  renders a neutral pre-formatted report and a per-platform title, with Retry
  gated on a `retry` flag (Telegram true, VK false). app.launchError is now a
  neutral LaunchDiag { platform, report, retry }.
- New lib/launchdiag.ts holds the shared pieces both platforms reuse: the
  LaunchDiag shape, the client-environment lines, and the query field-NAME
  reader (moved out of telegram.ts so VK does not duplicate them).

Tests: pure vkDiagLines units, incl. a guard that the `sign` value never leaks
into the report. i18n: launch.errorTitleVk (en/ru). Docs: FUNCTIONAL (+ru) user
story and ARCHITECTURE entry-path note.

docs/FUNCTIONAL.md

@@ -72,7 +72,10 @@ A **VK Mini App** launch works the same way: it authenticates from VK's signed l
 `vk_language` and its display name from the VK profile (read on the client, since VK does not put
 the name in the signed launch). While the theme preference is "auto" the app follows the VK
 client's light/dark scheme, and the layout clears the VK mobile home bar. The same quiet-retry
-"couldn't load" screen applies inside VK.
+"couldn't load" screen applies inside VK. Opening a Mini App link directly in an ordinary browser —
+the `/vk/` entry with no signed VK launch, or `/telegram/` with no Telegram sign-in data — shows a
+compact, shareable diagnostic screen instead of proceeding (as a throwaway guest on VK, or by
+redirecting away on Telegram), so a player who ends up there wrongly can screenshot it for us.
 **Email** sign-in (web) mails a branded six-digit confirmation code — localized
 (en/ru), no images — to the address; entering it signs the player in. A new address
 is provisioned on the first request but only becomes a durable account once the code