fix(vk): friend-code link is the plain vk.com/app link (VK strips iframe query payload)

The contour diagnostic confirmed VK forwards only the signed vk_* params to the iframe — a
custom payload on the app link is dropped (the '#' eaten by the vk.com SPA, a '?' query
stripped), so the friend-code cannot ride the link. The VK share link is now just
vk.com/app<id>; the recipient enters the copied code by hand (VKWebAppCopyText works). The
vkStartParam reader + bootVK routing stay as a no-op, ready for a post-moderation channel.
Removes the temporary deep-link diagnostic.

ui/src/lib/deeplink.ts

@@ -78,14 +78,14 @@ export function shareLink(param: string): string | null {
 }
 
 /**
- * vkShareLink wraps a deep-link start parameter in a VK Mini App link
- * (https://vk.com/app<id>?hash=<param>), read back by vk.ts vkStartParam (the `hash` query param).
- * VK's documented '#' direct-link form is consumed by the vk.com SPA before it reaches the app, so
- * we pass the payload as a query parameter instead. Returns null when the VK app id is unknown
- * (outside a VK launch), so the caller falls back to the Telegram/web link.
+ * vkShareLink returns the VK Mini App link (https://vk.com/app<id>) to share on VK, or null when the
+ * VK app id is unknown (outside a VK launch). VK forwards no custom payload through the app link to
+ * the iframe — the '#' form is eaten by the vk.com SPA and a '?' query is dropped (confirmed on the
+ * contour: only the signed vk_* params arrive) — so the link cannot carry the friend code; the
+ * recipient enters the copied code by hand.
  */
-export function vkShareLink(param: string): string | null {
+export function vkShareLink(): string | null {
   const id = vkAppId();
   if (!id) return null;
-  return `https://vk.com/app${id}?hash=${encodeURIComponent(param)}`;
+  return `https://vk.com/app${id}`;
 }