Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

gateway/internal/transcode/transcode.go

@@ -9,8 +9,8 @@ import (
 	"context"
 	"errors"
 
-	"scrabble/gateway/internal/auth"
 	"scrabble/gateway/internal/backendclient"
+	"scrabble/gateway/internal/connector"
 	fb "scrabble/pkg/fbs/scrabblefb"
 )
 
@@ -63,10 +63,16 @@ type Registry struct {
 	ops map[string]Op
 }
 
+// TelegramValidator validates Mini App launch data via the connector side-service.
+// *connector.Client implements it; a nil value disables the telegram auth path.
+type TelegramValidator interface {
+	ValidateInitData(ctx context.Context, initData string) (connector.User, error)
+}
+
 // NewRegistry builds the slice's message-type catalog over the backend client.
-// The Telegram auth op is registered only when a validator is supplied (a bot
-// token is configured); otherwise auth.telegram is simply unknown.
-func NewRegistry(backend *backendclient.Client, tg auth.TelegramValidator) *Registry {
+// The Telegram auth op is registered only when a validator is supplied (the
+// connector is configured); otherwise auth.telegram is simply unknown.
+func NewRegistry(backend *backendclient.Client, tg TelegramValidator) *Registry {
 	r := &Registry{ops: make(map[string]Op)}
 	if tg != nil {
 		r.ops[MsgAuthTelegram] = Op{Handler: authTelegramHandler(backend, tg)}
@@ -109,20 +115,20 @@ func DomainCode(err error) (string, bool) {
 	if errors.As(err, &apiErr) {
 		return apiErr.Code, true
 	}
-	if errors.Is(err, auth.ErrInvalidInitData) {
+	if errors.Is(err, connector.ErrInvalidInitData) {
 		return "invalid_init_data", true
 	}
 	return "", false
 }
 
-func authTelegramHandler(backend *backendclient.Client, tg auth.TelegramValidator) Handler {
+func authTelegramHandler(backend *backendclient.Client, tg TelegramValidator) Handler {
 	return func(ctx context.Context, req Request) ([]byte, error) {
 		in := fb.GetRootAsTelegramLoginRequest(req.Payload, 0)
-		user, err := tg.Validate(string(in.InitData()))
+		user, err := tg.ValidateInitData(ctx, string(in.InitData()))
 		if err != nil {
 			return nil, err
 		}
-		sess, err := backend.TelegramAuth(ctx, user.ID)
+		sess, err := backend.TelegramAuth(ctx, user.ExternalID, user.LanguageCode, user.Username, user.FirstName)
 		if err != nil {
 			return nil, err
 		}