Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

ui/src/lib/telegram.ts

@@ -0,0 +1,67 @@
+// Telegram Mini App SDK access. The official telegram-web-app.js (loaded in
+// index.html) exposes window.Telegram.WebApp; this wraps the subset the app uses:
+// launch detection, initData (for auth.telegram), the deep-link start parameter,
+// theme params, and ready()/expand(). Every helper is safe to call outside Telegram.
+
+import type { TelegramThemeParams } from './theme';
+
+interface TelegramWebApp {
+  initData: string;
+  initDataUnsafe?: { start_param?: string };
+  themeParams?: TelegramThemeParams;
+  ready?: () => void;
+  expand?: () => void;
+}
+
+function webApp(): TelegramWebApp | undefined {
+  if (typeof window === 'undefined') return undefined;
+  return (window as unknown as { Telegram?: { WebApp?: TelegramWebApp } }).Telegram?.WebApp;
+}
+
+/**
+ * insideTelegram reports whether the app launched as a Telegram Mini App — the SDK
+ * is present and carries non-empty initData (an ordinary browser tab has neither).
+ */
+export function insideTelegram(): boolean {
+  const w = webApp();
+  return !!w && typeof w.initData === 'string' && w.initData.length > 0;
+}
+
+/** TelegramLaunch is the data a Mini App launch carries. */
+export interface TelegramLaunch {
+  initData: string;
+  startParam: string;
+  theme: TelegramThemeParams | undefined;
+}
+
+/**
+ * telegramLaunch readies the Mini App (full-height, ready signal) and returns its
+ * launch data: the raw initData (for auth.telegram), the deep-link start parameter
+ * (from the SDK or, for a bot web_app button, the page URL), and the theme params.
+ */
+export function telegramLaunch(): TelegramLaunch {
+  const w = webApp();
+  if (!w) return { initData: '', startParam: startParamFromURL(), theme: undefined };
+  w.ready?.();
+  w.expand?.();
+  const startParam = w.initDataUnsafe?.start_param ?? startParamFromURL();
+  return { initData: w.initData, startParam, theme: w.themeParams };
+}
+
+/**
+ * startParamFromURL reads a startapp parameter from the page URL — a bot web_app
+ * launch button carries the deep-link there rather than in initDataUnsafe.
+ */
+function startParamFromURL(): string {
+  if (typeof location === 'undefined') return '';
+  return new URLSearchParams(location.search).get('startapp') ?? '';
+}
+
+/**
+ * onTelegramPath reports whether the app is served under the dedicated Telegram
+ * entry path (/telegram/); outside Telegram on that path the app refuses to render.
+ */
+export function onTelegramPath(): boolean {
+  if (typeof location === 'undefined') return false;
+  return location.pathname.startsWith('/telegram/');
+}