Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

ui/e2e/telegram.spec.ts

@@ -0,0 +1,45 @@
+import { expect, test } from './fixtures';
+
+// The shared fixture already neutralises the real telegram-web-app.js, so these
+// specs control window.Telegram deterministically (injected below) with no network.
+
+// A minimal valid-looking Telegram WebApp stub: non-empty initData triggers the Mini
+// App launch path (the mock gateway accepts any initData and returns a durable
+// session); themeParams override the design tokens.
+function webAppStub(startParam = '') {
+  return {
+    Telegram: {
+      WebApp: {
+        initData: 'query_id=test&user=%7B%22id%22%3A1%7D&auth_date=1&hash=deadbeef',
+        initDataUnsafe: startParam ? { start_param: startParam } : {},
+        themeParams: { bg_color: '#101418', text_color: '#ffffff' },
+        ready() {},
+        expand() {},
+      },
+    },
+  };
+}
+
+test('Telegram launch auto-authenticates into the lobby and applies the theme', async ({ page }) => {
+  await page.addInitScript((stub) => {
+    Object.assign(window, stub);
+  }, webAppStub());
+  await page.goto('/');
+
+  // No guest-login click: the Mini App authenticates from initData and lands on the lobby.
+  await expect(page.getByText('Active games')).toBeVisible();
+
+  // The Telegram themeParams override the background token at runtime.
+  await expect
+    .poll(() => page.evaluate(() => getComputedStyle(document.documentElement).getPropertyValue('--bg').trim()))
+    .toBe('#101418');
+});
+
+test('outside Telegram, the /telegram/ entry redirects to the site root', async ({ page }) => {
+  await page.goto('/telegram/');
+
+  // The guard sends a non-Telegram visitor back to the root, where the normal
+  // (guest / email) login is shown.
+  await expect(page.getByRole('button', { name: /guest/i })).toBeVisible();
+  await expect(page).not.toHaveURL(/\/telegram\//);
+});