feat(profile): sign-in methods matrix — email add/change, provider link/unlink

Profile shows the account's sign-in methods for guests and durable accounts alike:
add or change email, link Telegram on the web (login widget), and unlink a linked
provider. Email is never unlinked (it is changed); unlink is offered only when
another identity remains, and a change to an address owned by another account shows
the non-disclosing 'check the address or contact support'. Add-VK-on-web stays
deferred (no VK OAuth).

Wires linkUnlink / changeEmailRequest / changeEmailConfirm through the client,
transport, mock and codec (encodeLinkUnlink + LinkResult 'unlinked'/'changed'
statuses); codec wire tests; ru/en i18n.

ui/src/lib/transport.ts

@@ -268,6 +268,15 @@ export function createTransport(baseUrl: string): GatewayClient {
     async linkTelegramMerge(data) {
       return codec.decodeLinkResult(await exec('link.telegram.merge', codec.encodeLinkTelegram(data)));
     },
+    async linkUnlink(kind) {
+      return codec.decodeLinkResult(await exec('link.unlink', codec.encodeLinkUnlink(kind)));
+    },
+    async changeEmailRequest(email) {
+      await exec('link.email.change.request', codec.encodeLinkEmailRequest(email));
+    },
+    async changeEmailConfirm(email, code) {
+      return codec.decodeLinkResult(await exec('link.email.change.confirm', codec.encodeLinkEmailConfirm(email, code)));
+    },
     async statsGet() {
       return codec.decodeStats(await exec('stats.get', codec.empty()));
     },