Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

gateway/cmd/gateway/main.go

@@ -18,9 +18,9 @@ import (
 	"go.uber.org/zap"
 
 	"scrabble/gateway/internal/admin"
-	"scrabble/gateway/internal/auth"
 	"scrabble/gateway/internal/backendclient"
 	"scrabble/gateway/internal/config"
+	"scrabble/gateway/internal/connector"
 	"scrabble/gateway/internal/connectsrv"
 	"scrabble/gateway/internal/push"
 	"scrabble/gateway/internal/ratelimit"
@@ -73,14 +73,20 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 	limiter := ratelimit.New()
 	hub := push.NewHub(0)
 
-	var tg auth.TelegramValidator
-	if cfg.TelegramBotToken != "" {
-		tg = auth.NewHMACValidator(cfg.TelegramBotToken)
+	var conn *connector.Client
+	var validator transcode.TelegramValidator
+	if cfg.ConnectorAddr != "" {
+		conn, err = connector.New(cfg.ConnectorAddr)
+		if err != nil {
+			return err
+		}
+		defer func() { _ = conn.Close() }()
+		validator = conn
 	} else {
-		logger.Warn("telegram auth disabled (GATEWAY_TELEGRAM_BOT_TOKEN unset)")
+		logger.Warn("telegram disabled (GATEWAY_CONNECTOR_ADDR unset)")
 	}
 
-	registry := transcode.NewRegistry(backend, tg)
+	registry := transcode.NewRegistry(backend, validator)
 	edge := connectsrv.NewServer(connectsrv.Deps{
 		Registry:  registry,
 		Sessions:  sessions,
@@ -91,8 +97,9 @@ func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
 		Logger:    logger,
 	})
 
-	// Bridge the backend push stream into the fan-out hub.
-	go runPushPump(ctx, backend, hub, logger)
+	// Bridge the backend push stream into the fan-out hub (and the out-of-app
+	// channel via the connector).
+	go runPushPump(ctx, backend, hub, conn, logger)
 
 	public := &http.Server{Addr: cfg.HTTPAddr, Handler: edge.HTTPHandler()}
 	servers := []*namedServer{{name: "public", srv: public}}
@@ -153,8 +160,10 @@ func runServers(ctx context.Context, cancel context.CancelFunc, servers []*named
 }
 
 // runPushPump keeps a backend push subscription open, forwarding every event to
-// the hub and re-subscribing after the stream ends, until the context is done.
-func runPushPump(ctx context.Context, backend *backendclient.Client, hub *push.Hub, logger *zap.Logger) {
+// the hub and re-subscribing after the stream ends, until the context is done. For
+// the out-of-app push kinds it also routes events whose recipient has no live
+// in-app stream to the platform connector (a nil connector disables that channel).
+func runPushPump(ctx context.Context, backend *backendclient.Client, hub *push.Hub, conn *connector.Client, logger *zap.Logger) {
 	for ctx.Err() == nil {
 		stream, err := backend.SubscribePush(ctx, gatewayID)
 		if err != nil {
@@ -178,6 +187,12 @@ func runPushPump(ctx context.Context, backend *backendclient.Client, hub *push.H
 				Payload: ev.GetPayload(),
 				EventID: ev.GetEventId(),
 			})
+			// Out-of-app fallback: when the recipient has no live in-app stream,
+			// deliver the event over the platform push channel. Done in a goroutine
+			// so a slow connector never stalls the in-app firehose.
+			if conn != nil && connector.OutOfAppKind(ev.GetKind()) && !hub.HasSubscribers(ev.GetUserId()) {
+				go deliverOutOfApp(ctx, backend, conn, ev.GetUserId(), ev.GetKind(), ev.GetPayload(), logger)
+			}
 		}
 		if !sleep(ctx, pushReconnectDelay) {
 			return
@@ -185,6 +200,24 @@ func runPushPump(ctx context.Context, backend *backendclient.Client, hub *push.H
 	}
 }
 
+// deliverOutOfApp resolves the recipient's push target and, when they have a
+// Telegram identity and have not confined notifications to the app, asks the
+// connector to deliver the event. It is best-effort: every failure is logged and
+// dropped (the in-app stream remains the primary channel).
+func deliverOutOfApp(ctx context.Context, backend *backendclient.Client, conn *connector.Client, userID, kind string, payload []byte, logger *zap.Logger) {
+	target, err := backend.PushTarget(ctx, userID)
+	if err != nil {
+		logger.Warn("push target lookup failed", zap.String("user_id", userID), zap.Error(err))
+		return
+	}
+	if !connector.DeliverToTarget(target.ExternalID, target.NotificationsInAppOnly) {
+		return
+	}
+	if _, err := conn.Notify(ctx, target.ExternalID, kind, payload, target.Language); err != nil {
+		logger.Warn("out-of-app notify failed", zap.String("kind", kind), zap.Error(err))
+	}
+}
+
 // sleep waits for d or until ctx is cancelled, reporting whether it waited the
 // full duration.
 func sleep(ctx context.Context, d time.Duration) bool {