feat(vk): native share/copy, auto theme, friend-code deep link, home-bar safe area

Group B of the VK integration — the contour-verified follow-up to the launch+auth MVP:

- Share/copy inside the VK iframe go through VK Bridge: the friend-code invite shares via
  VKWebAppShare and copies via VKWebAppCopyText, since navigator.share is absent in the desktop
  iframe and navigator.clipboard is blocked there.
- The invite link is a VK Mini App direct link (vk.com/app<id>#f<code>) on VK instead of the
  Telegram link; the app id comes from vk_app_id in the launch params (no build arg needed). The
  recipient's launch routes the deep link from VK's `hash` launch query parameter.
- The app's "auto" theme follows the VK client's light/dark appearance (VKWebAppUpdateConfig),
  which the VK mobile webview's prefers-color-scheme does not track.
- The safe-area CSS vars default to env(safe-area-inset-*), so the VK mobile layout clears the
  home bar (and Capacitor/PWA too); Telegram still overrides them from its SDK.

vk.ts adds vkAppId/vkStartParam/vkShare/vkCopyText/vkOnScheme. Verified: svelte-check, 347 unit
(+ vkAppId/vkStartParam/vkShareLink), build, bundle-gate. The VK-Bridge behaviours need the live
contour (not reproducible headless).

ui/src/app.css

@@ -46,14 +46,16 @@
   /* Height Telegram's native nav overlays at the top in fullscreen; set from the SDK's
      content-safe-area inset, 0 elsewhere. */
   --tg-content-top: 0px;
-  /* Telegram device safe-area top (the notch); TG's own nav controls sit between it and
-     --tg-content-top, so the in-app header aligns to that band, 0 elsewhere. */
-  --tg-safe-top: 0px;
-  /* Telegram device safe-area bottom / sides (home indicator; landscape notch), 0 elsewhere —
-     the screen pads its bottom and left/right edges by these so content clears the cut-outs. */
-  --tg-safe-bottom: 0px;
-  --tg-safe-left: 0px;
-  --tg-safe-right: 0px;
+  /* Device safe-area top (the notch); inside Telegram TG's own nav controls sit between it and
+     --tg-content-top, so the in-app header aligns to that band. Inside Telegram these are set from
+     the SDK (lib/app.svelte.ts); elsewhere they fall back to the CSS env() safe area, so a VK Mini
+     App / Capacitor / PWA webview clears the device cut-outs too (a plain browser tab reports 0). */
+  --tg-safe-top: env(safe-area-inset-top, 0px);
+  /* Device safe-area bottom / sides (home indicator; landscape notch) — the screen pads its bottom
+     and left/right edges by these so content clears the cut-outs (e.g. the VK mobile home bar). */
+  --tg-safe-bottom: env(safe-area-inset-bottom, 0px);
+  --tg-safe-left: env(safe-area-inset-left, 0px);
+  --tg-safe-right: env(safe-area-inset-right, 0px);
   --font: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial,
     "Noto Sans", "Liberation Sans", sans-serif;
   --shadow: 0 1px 2px rgba(0, 0, 0, 0.08), 0 6px 16px rgba(0, 0, 0, 0.06);