feat(vk): show a launch diagnostic on a direct /vk/ open instead of a guest

Opening the dedicated /vk/ entry directly in an ordinary browser (no signed VK
launch) fell through to the web flow and silently started a throwaway guest,
which is wrong for a VK-only entry. Mirror the existing /telegram/ launch-error
behaviour: render a compact, shareable, privacy-safe diagnostic screen instead.

- Boot: a new branch `onVKPath() && !insideVK()` sets app.launchError and stops
  the fall-through, the VK counterpart of the /telegram/ diagnostic guard.
- Diagnostic (passive, no VK Bridge round-trip): reads the URL launch-parameter
  NAMES (never the `sign` value — auth material), whether the URL was signed,
  `vk_platform`, the iframe/referrer context, plus the shared client-environment
  lines. VK signs the launch URL at load, so — unlike Telegram's initData — the
  parameters never arrive late; hence the VK screen offers Share only, no Retry.
- Generalise the screen: TelegramLaunchError.svelte -> LaunchError.svelte, which
  renders a neutral pre-formatted report and a per-platform title, with Retry
  gated on a `retry` flag (Telegram true, VK false). app.launchError is now a
  neutral LaunchDiag { platform, report, retry }.
- New lib/launchdiag.ts holds the shared pieces both platforms reuse: the
  LaunchDiag shape, the client-environment lines, and the query field-NAME
  reader (moved out of telegram.ts so VK does not duplicate them).

Tests: pure vkDiagLines units, incl. a guard that the `sign` value never leaks
into the report. i18n: launch.errorTitleVk (en/ru). Docs: FUNCTIONAL (+ru) user
story and ARCHITECTURE entry-path note.

ui/src/lib/vk.test.ts

@@ -5,7 +5,9 @@ import {
   routeExternalLinkInVK,
   vkAndroidWebView,
   vkAppId,
+  vkDiagLines,
   vkExternalBrowserUrl,
+  vkLaunchDiag,
   vkLaunchParams,
   vkStartParam,
   appearanceForBg,
@@ -119,6 +121,45 @@ describe('vk external links', () => {
   });
 });
 
+describe('vkDiagLines (launch diagnostic)', () => {
+  it('reports an unsigned browser open: no sign, every VK param missing', () => {
+    const lines = vkDiagLines('utm_source=catalog', false, '');
+    expect(lines[0]).toBe('launch: unsigned   iframe: no');
+    expect(lines[1]).toBe('vk-platform: —');
+    expect(lines[2]).toBe('params: utm_source');
+    expect(lines[3]).toBe('missing: vk_app_id,vk_user_id,vk_ts,vk_platform,sign');
+    expect(lines[4]).toBe('referrer: —');
+  });
+
+  it('reports a signed launch and never leaks the sign value, only its name', () => {
+    const lines = vkDiagLines(
+      'vk_app_id=6736218&vk_platform=mobile_android&vk_user_id=42&vk_ts=1700000000&sign=SECRETSIG',
+      true,
+      'vk.com',
+    );
+    expect(lines[0]).toBe('launch: signed   iframe: yes');
+    expect(lines[1]).toBe('vk-platform: mobile_android');
+    expect(lines[3]).toBe('missing: —');
+    expect(lines[4]).toBe('referrer: vk.com');
+    // The signature is auth material: its NAME may appear, its VALUE must never.
+    const report = lines.join('\n');
+    expect(report).toContain('sign');
+    expect(report).not.toContain('SECRETSIG');
+  });
+});
+
+describe('vkLaunchDiag', () => {
+  afterEach(() => vi.unstubAllGlobals());
+
+  it('builds a VK launch diagnostic with no Retry (VK signs the URL at load, nothing to wait for)', () => {
+    vi.stubGlobal('location', { pathname: '/vk/', search: '?utm_source=catalog' });
+    const d = vkLaunchDiag();
+    expect(d.platform).toBe('vk');
+    expect(d.retry).toBe(false);
+    expect(d.report).toContain('launch: unsigned');
+  });
+});
+
 describe('appearanceForBg', () => {
   it('maps a dark background to the dark appearance (light status-bar icons)', () => {
     expect(appearanceForBg('#0f1115')).toBe('dark');