Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

platform/telegram/cmd/telegram/main.go

@@ -0,0 +1,94 @@
+// Command telegram is the Telegram platform side-service (the "connector"). It is
+// the only component holding the bot token: it runs the Bot API long-poll loop
+// (Mini App launch + /start deep-links) and serves the connector gRPC API
+// (pkg/proto/telegram/v1) that the gateway and backend call over the trusted
+// internal network. See platform/telegram/README.md.
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net"
+	"os/signal"
+	"syscall"
+
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+
+	telegramv1 "scrabble/pkg/proto/telegram/v1"
+	"scrabble/platform/telegram/internal/bot"
+	"scrabble/platform/telegram/internal/config"
+	"scrabble/platform/telegram/internal/connector"
+	"scrabble/platform/telegram/internal/initdata"
+)
+
+func main() {
+	cfg, err := config.Load()
+	if err != nil {
+		log.Fatalf("telegram: load config: %v", err)
+	}
+	logger, err := newLogger(cfg.LogLevel)
+	if err != nil {
+		log.Fatalf("telegram: build logger: %v", err)
+	}
+	defer func() { _ = logger.Sync() }()
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	if err := run(ctx, cfg, logger); err != nil {
+		logger.Fatal("telegram: terminated", zap.Error(err))
+	}
+}
+
+// run wires the bot and the gRPC server and serves both until the context is
+// cancelled.
+func run(ctx context.Context, cfg config.Config, logger *zap.Logger) error {
+	b, err := bot.New(bot.Config{
+		Token:      cfg.BotToken,
+		APIBaseURL: cfg.APIBaseURL,
+		TestEnv:    cfg.TestEnv,
+		MiniAppURL: cfg.MiniAppURL,
+	}, logger)
+	if err != nil {
+		return err
+	}
+	srv := connector.NewServer(initdata.NewHMACValidator(cfg.BotToken), b, cfg.GameChannelID, logger)
+
+	grpcServer := grpc.NewServer()
+	telegramv1.RegisterTelegramServer(grpcServer, srv)
+
+	lis, err := net.Listen("tcp", cfg.GRPCAddr)
+	if err != nil {
+		return err
+	}
+
+	// The long-poll loop and the gRPC server run together; cancelling the context
+	// stops the bot loop and gracefully drains the gRPC server.
+	go b.Run(ctx)
+	go func() {
+		<-ctx.Done()
+		grpcServer.GracefulStop()
+	}()
+
+	logger.Info("telegram connector starting",
+		zap.String("grpc_addr", cfg.GRPCAddr),
+		zap.String("miniapp_url", cfg.MiniAppURL),
+		zap.Bool("test_env", cfg.TestEnv))
+	if err := grpcServer.Serve(lis); err != nil && !errors.Is(err, grpc.ErrServerStopped) {
+		return err
+	}
+	return nil
+}
+
+// newLogger builds a production JSON logger at the given level.
+func newLogger(level string) (*zap.Logger, error) {
+	var lvl zap.AtomicLevel
+	if err := lvl.UnmarshalText([]byte(level)); err != nil {
+		return nil, err
+	}
+	cfg := zap.NewProductionConfig()
+	cfg.Level = lvl
+	return cfg.Build()
+}