feat(vk): show a launch diagnostic on a direct /vk/ open instead of a guest

Opening the dedicated /vk/ entry directly in an ordinary browser (no signed VK
launch) fell through to the web flow and silently started a throwaway guest,
which is wrong for a VK-only entry. Mirror the existing /telegram/ launch-error
behaviour: render a compact, shareable, privacy-safe diagnostic screen instead.

- Boot: a new branch `onVKPath() && !insideVK()` sets app.launchError and stops
  the fall-through, the VK counterpart of the /telegram/ diagnostic guard.
- Diagnostic (passive, no VK Bridge round-trip): reads the URL launch-parameter
  NAMES (never the `sign` value — auth material), whether the URL was signed,
  `vk_platform`, the iframe/referrer context, plus the shared client-environment
  lines. VK signs the launch URL at load, so — unlike Telegram's initData — the
  parameters never arrive late; hence the VK screen offers Share only, no Retry.
- Generalise the screen: TelegramLaunchError.svelte -> LaunchError.svelte, which
  renders a neutral pre-formatted report and a per-platform title, with Retry
  gated on a `retry` flag (Telegram true, VK false). app.launchError is now a
  neutral LaunchDiag { platform, report, retry }.
- New lib/launchdiag.ts holds the shared pieces both platforms reuse: the
  LaunchDiag shape, the client-environment lines, and the query field-NAME
  reader (moved out of telegram.ts so VK does not duplicate them).

Tests: pure vkDiagLines units, incl. a guard that the `sign` value never leaks
into the report. i18n: launch.errorTitleVk (en/ru). Docs: FUNCTIONAL (+ru) user
story and ARCHITECTURE entry-path note.

ui/src/lib/app.svelte.ts

@@ -14,8 +14,7 @@ import { applyReduceMotion, applyTelegramTheme, applyTheme, type ThemePref, type
 import {
   insideTelegram,
   telegramClose,
-  collectTelegramDiag,
-  type TelegramDiag,
+  telegramLaunchDiag,
   onTelegramPath,
   hasLaunchFragment,
   loadTelegramSDK,
@@ -33,7 +32,8 @@ import {
   telegramCloudGet,
   telegramCloudSet,
 } from './telegram';
-import { onVKPath, insideVK, vkInit, vkClose, vkDisableSwipeBack, vkLaunchParams, vkUserName, vkStartParam, vkOnScheme, vkOnInsets, vkSetViewSettings, appearanceForBg } from './vk';
+import { onVKPath, insideVK, vkLaunchDiag, vkInit, vkClose, vkDisableSwipeBack, vkLaunchParams, vkUserName, vkStartParam, vkOnScheme, vkOnInsets, vkSetViewSettings, appearanceForBg } from './vk';
+import type { LaunchDiag } from './launchdiag';
 import { pendingVKLink, type VKLinkCallback } from './vkid';
 import { isStandalone } from './pwa';
 import { registerServiceWorker } from './pwa.svelte';
@@ -82,11 +82,12 @@ export const app = $state<{
    *  backend was down during a deploy). App.svelte then renders the boot-error retry screen
    *  instead of the web login — a Mini App has no manual sign-in to fall back to. */
   bootError: boolean;
-  /** On the dedicated /telegram/ entry, set to a privacy-safe diagnostic snapshot when a Mini App
-   *  launch carried no sign-in data (empty initData). App.svelte then renders the compact
-   *  launch-error screen (screens/TelegramLaunchError) — a shareable probe for why Telegram
-   *  delivered no initData (seen on some Android clients) — instead of bouncing to the landing. */
-  launchError: TelegramDiag | null;
+  /** On a dedicated Mini App entry (/telegram/ or /vk/) opened without a valid launch, set to a
+   *  privacy-safe diagnostic snapshot. App.svelte then renders the compact, shareable launch-error
+   *  screen (screens/LaunchError) — a probe for why Telegram delivered no initData (seen on some
+   *  Android clients), or why /vk/ carried no signed launch — instead of bouncing to the landing
+   *  (Telegram) or silently proceeding as a guest (VK). */
+  launchError: LaunchDiag | null;
   /** Whether the hidden on-device debug panel (components/DebugPanel) is open — toggled by tapping
    *  the header title ten times in quick succession. A support aid; carries no secrets. */
   debugOpen: boolean;
@@ -850,7 +851,7 @@ export async function bootstrap(): Promise<void> {
   // clients), render the compact launch-error screen with a diagnostic snapshot the user can share
   // with the developer, instead of bouncing the visitor to the marketing landing.
   if (onTelegramPath() && !insideTelegram()) {
-    app.launchError = collectTelegramDiag();
+    app.launchError = telegramLaunchDiag();
     app.ready = true;
     return;
   }
@@ -875,10 +876,19 @@ export async function bootstrap(): Promise<void> {
     return;
   }
 
+  // The dedicated /vk/ entry opened without a signed VK launch (a plain browser tab, or a VK client
+  // that delivered no launch parameters) shows the compact, shareable launch diagnostic instead of
+  // silently proceeding as a guest — the VK counterpart of the /telegram/ launch-error screen. VK puts
+  // its signed parameters in the launch URL at load, so there is nothing to wait for (hence no Retry).
+  if (onVKPath() && !insideVK()) {
+    app.launchError = vkLaunchDiag();
+    app.ready = true;
+    return;
+  }
+
   // VK Mini App launch: signal readiness to the VK client (which dismisses its loading cover), then
   // authenticate from the signed launch parameters in the URL — the display name comes from
-  // VKWebAppGetUserInfo, since VK omits it from the signed params. The /vk/ entry opened outside VK
-  // (no signed params — e.g. a developer hitting the URL directly) falls through to the web flow.
+  // VKWebAppGetUserInfo, since VK omits it from the signed params.
   if (onVKPath() && insideVK()) {
     // Follow the VK client's light/dark appearance while the user keeps the app's "auto" theme (the
     // VK mobile webview's prefers-color-scheme does not track it).
@@ -1072,7 +1082,7 @@ export async function retryTelegramLaunch(): Promise<void> {
   // Re-attempt the SDK load — the network may have recovered since the launch-error screen showed.
   await loadTelegramSDK(TELEGRAM_SDK_TIMEOUT_MS);
   if (!insideTelegram()) {
-    app.launchError = collectTelegramDiag();
+    app.launchError = telegramLaunchDiag();
     return;
   }
   app.launchError = null;