fix(vk): friend-code link is the plain vk.com/app link (VK strips iframe query payload)

The contour diagnostic confirmed VK forwards only the signed vk_* params to the iframe — a
custom payload on the app link is dropped (the '#' eaten by the vk.com SPA, a '?' query
stripped), so the friend-code cannot ride the link. The VK share link is now just
vk.com/app<id>; the recipient enters the copied code by hand (VKWebAppCopyText works). The
vkStartParam reader + bootVK routing stay as a no-op, ready for a post-moderation channel.
Removes the temporary deep-link diagnostic.

.claude/vk-games-integration.md

@@ -90,11 +90,14 @@ The bridge talks to the embedding VK client over postMessage; it is NOT an exter
 it has no telegram.org-style load-hang risk. The SDK reads browser globals at import — we import
 it **lazily** so the pure URL helpers stay node-test-importable.
 
-**Deep links** (direct-link launch): `https://vk.com/app<id>#<payload>` forwards everything after the
-`#` to the app as the **`hash` launch query parameter** (it is also in `location.hash`, but that
-collides with our hash router, so read the `hash` query param). `?` query strings are NOT supported
-for VK direct links. The friend-code invite is built as `vk.com/app<id>#f<code>` — the app id comes
-from `vk_app_id` in the launch params (no `VITE_VK_APP_ID` needed) — and read back via `vkStartParam`.
+**Deep links — NOT possible on VK (confirmed on the contour).** The VK iframe receives ONLY the signed
+`vk_*` launch params (+ `sign`); VK strips any custom data from the app link. The documented
+`vk.com/app<id>#<payload>` form is eaten by the vk.com SPA (which owns the URL hash), and a
+`vk.com/app<id>?hash=<payload>` query is dropped (the diagnostic showed `rawSearch` with only `vk_*`
+and an empty `hash`). So the friend-code invite link is just `vk.com/app<id>` (`vkShareLink`, app id
+from `vk_app_id`); the recipient enters the **copied code by hand** (`VKWebAppCopyText` works). The
+`vkStartParam` reader + the `bootVK` routing stay as a no-op today, ready if a post-moderation VK
+channel (e.g. an invite API) ever delivers a payload.
 
 ## 5. Test mode (to verify before moderation)