fix(vk): friend-code link is the plain vk.com/app link (VK strips iframe query payload)

The contour diagnostic confirmed VK forwards only the signed vk_* params to the iframe — a
custom payload on the app link is dropped (the '#' eaten by the vk.com SPA, a '?' query
stripped), so the friend-code cannot ride the link. The VK share link is now just
vk.com/app<id>; the recipient enters the copied code by hand (VKWebAppCopyText works). The
vkStartParam reader + bootVK routing stay as a no-op, ready for a post-moderation channel.
Removes the temporary deep-link diagnostic.

ui/src/lib/app.svelte.ts

@@ -751,19 +751,12 @@ async function bootVK(): Promise<void> {
   for (let attempt = 0; ; attempt++) {
     try {
       await adoptSession(await gateway.authVK(params, displayName));
-      // A VK direct-link deep link (vk.com/app<id>?hash=<param>) rides in as the `hash` launch param.
-      const sp = vkStartParam();
-      const diag = app.blocked ? 'blocked' : await routeStartParam(sp);
-      // TEMP VK deep-link diagnostic (remove after the contour catch): VK launches are not
-      // reproducible locally and the cold-boot path lands unexpectedly on the lobby, so surface
-      // the raw query, the parsed payload, the redeem outcome and the final route.
-      console.log('[VK deeplink]', {
-        rawSearch: typeof location !== 'undefined' ? location.search : '',
-        hash: sp,
-        outcome: diag,
-        route: router.route.name,
-      });
-      showToast(`VK dl: "${sp || '∅'}" -> ${diag}`);
+      // VK forwards only the signed vk_* params to the iframe — a custom payload on the app link
+      // (whether after '#', eaten by the vk.com SPA, or as a '?' query, dropped) never reaches it,
+      // confirmed on the contour. So there is no friend-code auto-redeem on VK in test mode: the
+      // launch lands on the lobby. vkStartParam stays as the reader for a future (post-moderation)
+      // deep-link channel, and routes the lobby for an empty payload today.
+      if (!app.blocked) await routeStartParam(vkStartParam());
       app.bootError = false;
       return;
     } catch (err) {
@@ -825,12 +818,12 @@ export async function retryTelegramLaunch(): Promise<void> {
  * specific game, the friends screen with a friend-code redemption, or the lobby
  * (where invitations surface as a badge).
  */
-async function routeStartParam(param: string): Promise<string> {
+async function routeStartParam(param: string): Promise<void> {
   const link = parseStartParam(param);
   switch (link.kind) {
     case 'game':
       navigate(`/game/${link.id}`);
-      return 'game:' + link.id;
+      return;
     case 'friendCode':
       try {
         const friend = await gateway.friendCodeRedeem(link.code);
@@ -843,7 +836,6 @@ async function routeStartParam(param: string): Promise<string> {
           showToast(t('friends.added', { name: friend.displayName }));
         }
         void refreshNotifications();
-        return 'friendCode ok: ' + friend.displayName;
       } catch (err) {
         const code = err instanceof GatewayError ? err.code : '';
         if (code === 'self_relation') {
@@ -851,22 +843,19 @@ async function routeStartParam(param: string): Promise<string> {
           // scary "can't do that to yourself" error.
           navigate('/friends');
           showToast(t('friends.selfInvite'));
-          return 'friendCode self_relation';
         } else if (code === 'friend_code_invalid') {
           // A previously shared link whose single-use, 12h code is already spent or expired:
           // land in the lobby and gently point at the bot, rather than a red error on Friends.
           navigate('/');
           app.staleInvite = true;
-          return 'friendCode invalid/stale -> lobby';
         } else {
           navigate('/friends');
           handleError(err);
-          return 'friendCode err: ' + (code || 'unknown');
         }
       }
+      return;
     default:
       navigate('/');
-      return 'lobby (empty/unknown param)';
   }
 }