Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

gateway/internal/transcode/transcode_telegram_test.go

@@ -0,0 +1,91 @@
+package transcode_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	flatbuffers "github.com/google/flatbuffers/go"
+
+	"scrabble/gateway/internal/connector"
+	"scrabble/gateway/internal/transcode"
+	fb "scrabble/pkg/fbs/scrabblefb"
+)
+
+// fakeValidator stands in for the connector's ValidateInitData RPC.
+type fakeValidator struct {
+	user connector.User
+	err  error
+}
+
+func (f fakeValidator) ValidateInitData(context.Context, string) (connector.User, error) {
+	return f.user, f.err
+}
+
+func telegramLoginPayload(initData string) []byte {
+	b := flatbuffers.NewBuilder(0)
+	off := b.CreateString(initData)
+	fb.TelegramLoginRequestStart(b)
+	fb.TelegramLoginRequestAddInitData(b, off)
+	b.Finish(fb.TelegramLoginRequestEnd(b))
+	return b.FinishedBytes()
+}
+
+func TestTelegramAuthForwardsSeedFields(t *testing.T) {
+	var gotBody map[string]string
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/internal/sessions/telegram" {
+			t.Errorf("unexpected path %q", r.URL.Path)
+		}
+		_ = json.NewDecoder(r.Body).Decode(&gotBody)
+		_, _ = w.Write([]byte(`{"token":"tok-tg","user_id":"u-tg","is_guest":false,"display_name":"Иван"}`))
+	})
+	defer cleanup()
+
+	v := fakeValidator{user: connector.User{ExternalID: "42", Username: "neo", FirstName: "Иван", LanguageCode: "ru"}}
+	reg := transcode.NewRegistry(backend, v)
+	op, ok := reg.Lookup(transcode.MsgAuthTelegram)
+	if !ok {
+		t.Fatal("auth.telegram not registered")
+	}
+
+	payload, err := op.Handler(context.Background(), transcode.Request{Payload: telegramLoginPayload("init")})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	sess := fb.GetRootAsSession(payload, 0)
+	if string(sess.Token()) != "tok-tg" || string(sess.UserId()) != "u-tg" {
+		t.Fatalf("session decoded wrong: token=%q user=%q", sess.Token(), sess.UserId())
+	}
+	// The validated launch fields are forwarded so the backend can seed a new account.
+	if gotBody["external_id"] != "42" || gotBody["language_code"] != "ru" || gotBody["first_name"] != "Иван" {
+		t.Errorf("forwarded body = %+v, want external_id=42 language_code=ru first_name=Иван", gotBody)
+	}
+}
+
+func TestTelegramAuthInvalidInitData(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(http.ResponseWriter, *http.Request) {
+		t.Error("backend must not be called when initData is invalid")
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, fakeValidator{err: connector.ErrInvalidInitData})
+	op, _ := reg.Lookup(transcode.MsgAuthTelegram)
+
+	_, err := op.Handler(context.Background(), transcode.Request{Payload: telegramLoginPayload("bad")})
+	if code, ok := transcode.DomainCode(err); !ok || code != "invalid_init_data" {
+		t.Errorf("DomainCode = (%q, %v), want (invalid_init_data, true)", code, ok)
+	}
+}
+
+// TestTelegramAuthDisabledWithoutConnector confirms a nil validator leaves
+// auth.telegram unregistered.
+func TestTelegramAuthDisabledWithoutConnector(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(http.ResponseWriter, *http.Request) {})
+	defer cleanup()
+	reg := transcode.NewRegistry(backend, nil)
+	if _, ok := reg.Lookup(transcode.MsgAuthTelegram); ok {
+		t.Error("auth.telegram should be unregistered without a connector")
+	}
+}