feat(vk): show a launch diagnostic on a direct /vk/ open instead of a guest

Opening the dedicated /vk/ entry directly in an ordinary browser (no signed VK
launch) fell through to the web flow and silently started a throwaway guest,
which is wrong for a VK-only entry. Mirror the existing /telegram/ launch-error
behaviour: render a compact, shareable, privacy-safe diagnostic screen instead.

- Boot: a new branch `onVKPath() && !insideVK()` sets app.launchError and stops
  the fall-through, the VK counterpart of the /telegram/ diagnostic guard.
- Diagnostic (passive, no VK Bridge round-trip): reads the URL launch-parameter
  NAMES (never the `sign` value — auth material), whether the URL was signed,
  `vk_platform`, the iframe/referrer context, plus the shared client-environment
  lines. VK signs the launch URL at load, so — unlike Telegram's initData — the
  parameters never arrive late; hence the VK screen offers Share only, no Retry.
- Generalise the screen: TelegramLaunchError.svelte -> LaunchError.svelte, which
  renders a neutral pre-formatted report and a per-platform title, with Retry
  gated on a `retry` flag (Telegram true, VK false). app.launchError is now a
  neutral LaunchDiag { platform, report, retry }.
- New lib/launchdiag.ts holds the shared pieces both platforms reuse: the
  LaunchDiag shape, the client-environment lines, and the query field-NAME
  reader (moved out of telegram.ts so VK does not duplicate them).

Tests: pure vkDiagLines units, incl. a guard that the `sign` value never leaks
into the report. i18n: launch.errorTitleVk (en/ru). Docs: FUNCTIONAL (+ru) user
story and ARCHITECTURE entry-path note.

ui/src/lib/telegram.ts

@@ -4,6 +4,7 @@
 // the app uses: launch detection, initData (for auth.telegram), the deep-link start parameter,
 // theme params, and ready()/expand(). Every helper is safe to call outside Telegram.
 
+import { clientEnvLines, queryFieldNames, type LaunchDiag } from './launchdiag';
 import type { TelegramThemeParams } from './theme';
 
 /** TelegramPopupButton is one button of a native showPopup (Bot API 6.2). */
@@ -471,24 +472,6 @@ export function hasLaunchFragment(): boolean {
  *  the launch-error screen reports. Only field names are ever inspected, never their values. */
 const expectedInitDataFields = ['user', 'auth_date', 'hash', 'signature'];
 
-interface uaBrand {
-  brand: string;
-  version: string;
-}
-
-interface uaDataValue {
-  platform?: string;
-  mobile?: boolean;
-  brands?: uaBrand[];
-}
-
-/** uaData returns the User-Agent Client Hints object (Chromium only — notably the Android Telegram
- *  webview), or undefined where it is unavailable (iOS / Safari / Firefox). */
-function uaData(): uaDataValue | undefined {
-  if (typeof navigator === 'undefined') return undefined;
-  return (navigator as unknown as { userAgentData?: uaDataValue }).userAgentData;
-}
-
 /** launchFragmentData returns the raw tgWebAppData carried in the URL fragment (the form Telegram
  *  appends on launch), or '' when absent. With no SDK present a non-empty value means Telegram
  *  delivered the data but telegram-web-app.js never ran to parse it. */
@@ -503,17 +486,6 @@ function launchFragmentData(): string {
   }
 }
 
-/** initDataFieldNames parses a Telegram initData (or raw fragment data) query string and returns
- *  only its field NAMES — never the values, since the hash / signature are auth material. */
-function initDataFieldNames(raw: string): string[] {
-  if (!raw) return [];
-  try {
-    return [...new URLSearchParams(raw).keys()];
-  } catch {
-    return [];
-  }
-}
-
 /**
  * TelegramDiag is a privacy-safe snapshot of why a Mini App launch lacked sign-in data, taken at
  * the moment of failure and rendered on the launch-error screen so a stuck user can share it with
@@ -542,30 +514,20 @@ export interface TelegramDiag {
   fieldsPresent: string[];
   /** The expected field names absent from the launch data (a subset of expectedInitDataFields). */
   fieldsMissing: string[];
-  /** The OS / platform per User-Agent Client Hints (else navigator.platform), e.g. 'Android', ''. */
-  osPlatform: string;
-  /** Whether the client reports itself mobile per Client Hints: 'yes' | 'no' | '' (unknown). */
-  mobile: string;
-  /** The browser brands + major versions per Client Hints (Chromium only), or ''. */
-  browser: string;
-  /** The full User-Agent string — the catch-all that also carries the OS version and webview build. */
-  userAgent: string;
 }
 
 /**
  * collectTelegramDiag captures a TelegramDiag snapshot of the current launch state. Call it at the
  * point a /telegram/ launch is found to lack sign-in data, so the snapshot reflects that moment —
- * sign-in data arriving late would otherwise mask the failure.
+ * sign-in data arriving late would otherwise mask the failure. telegramLaunchDiag wraps it into the
+ * neutral LaunchDiag the shared LaunchError screen renders.
  */
 export function collectTelegramDiag(): TelegramDiag {
   const w = webApp();
   const sdk = typeof window !== 'undefined' && !!(window as unknown as { Telegram?: unknown }).Telegram;
   const initData = w?.initData ?? '';
   const fragData = initData ? '' : launchFragmentData();
-  const present = initDataFieldNames(initData || fragData);
-  const ua = uaData();
-  const navPlatform =
-    typeof navigator === 'undefined' ? '' : (navigator as unknown as { platform?: string }).platform ?? '';
+  const present = queryFieldNames(initData || fragData);
   return {
     hasSDK: sdk,
     hasWebApp: !!w,
@@ -576,13 +538,29 @@ export function collectTelegramDiag(): TelegramDiag {
     hashHadTgData: fragData.length > 0,
     fieldsPresent: present,
     fieldsMissing: expectedInitDataFields.filter((f) => !present.includes(f)),
-    osPlatform: ua?.platform ?? navPlatform,
-    mobile: ua?.mobile === undefined ? '' : ua.mobile ? 'yes' : 'no',
-    browser: (ua?.brands ?? []).map((b) => `${b.brand} ${b.version}`).join(', '),
-    userAgent: typeof navigator === 'undefined' ? '' : navigator.userAgent,
   };
 }
 
+/**
+ * telegramLaunchDiag captures the current Telegram launch state as a neutral LaunchDiag for the shared
+ * LaunchError screen: the platform-specific lines (SDK load, initData length, field names) plus the
+ * shared client-environment lines. retry is true — Telegram's initData can arrive late on a slow
+ * client, so the screen's Retry can still recover the launch.
+ */
+export function telegramLaunchDiag(): LaunchDiag {
+  const d = collectTelegramDiag();
+  const report = [
+    `sdk-load: ${d.sdkLoad}`,
+    `sdk: ${d.hasSDK ? 'yes' : 'no'}   webapp: ${d.hasWebApp ? 'yes' : 'no'}`,
+    `tg-platform: ${d.platform || '—'}   tg-version: ${d.version || '—'}`,
+    `initData: ${d.initDataLen > 0 ? d.initDataLen : 'empty'}   tgdata-in-url: ${d.hashHadTgData ? 'yes' : 'no'}`,
+    `fields: ${d.fieldsPresent.join(',') || '—'}`,
+    `missing: ${d.fieldsMissing.join(',') || '—'}`,
+    ...clientEnvLines(),
+  ].join('\n');
+  return { platform: 'telegram', report, retry: true };
+}
+
 /**
  * telegramChromeDiag returns a compact, privacy-safe readout of Telegram's viewport / chrome state
  * (platform, version, fullscreen/expanded, viewport geometry, safe-area insets, SDK-load outcome,