feat(telegram): promo bot + channel-chat moderation gate

Add a second standalone promo bot to the bot container (answers /start with a
localized message + a URL button into the main bot's Mini App) and gate write
access in a channel's linked discussion chat: grant on join when the Telegram
user is registered and neither admin-suspended nor holding a new chat_muted
role, and revoke/grant on the matching moderation change for a member currently
in the chat.

Eligibility (registered AND NOT suspended AND NOT chat_muted; the game
suspension dominates) is resolved once in the backend and reached two ways: the
bot's join-time unary ResolveChatEligibility over the existing mTLS bot-link,
and a backend chat_access_changed event -> gateway -> ChatGate command
(idempotent; a temporary-block-expiry sweeper may over-emit). The bot guards the
block/unblock path with getChatMember, since bots cannot list members.

A web_app button cannot open another bot's Mini App (it signs initData with the
sending bot's token), so the promo button is a t.me ?startapp URL reusing the
UI's VITE_TELEGRAM_LINK. The bot must be a chat admin with the restrict-members
right and chat_member in its allowed updates.

No schema change: chat_muted reuses the data-driven account_roles table.

platform/telegram/README.md

@@ -42,6 +42,23 @@ Telegram identity to an account from a browser. Both map a rejection to gRPC
   launch button; a deep-link payload routes the launch to a game / invitation / friend
   code. This is **self-contained** — the bot never calls back into the game, so `/start`
   onboarding works even when the game is down.
+- **Moderated-chat gating.** When `TELEGRAM_CHAT_ID` names a channel's linked discussion
+  group, the bot gates who may write there. The group is configured **default no-send**
+  (a human setting); the bot grants write access to a user who **joins** when they are
+  registered and neither admin-suspended nor `chat_muted`, asking the gateway over the
+  bot-link (`ResolveChatEligibility`). When an operator blocks/unblocks an account or
+  toggles its `chat_muted` role, the gateway pushes a `ChatGate` command and the bot
+  applies it — but only to a member currently in the chat (it probes one user with
+  `getChatMember`, since bots cannot list members). The bot must be an **administrator**
+  there with the **"Ban users"** right (the Bot API `can_restrict_members`), and it
+  subscribes to `chat_member` updates, which Telegram delivers only to a chat admin.
+- **Promo bot (optional).** When `TELEGRAM_PROMO_BOT_TOKEN` is set, the container also
+  runs a **second, standalone** bot whose only job is to answer `/start` with a localized
+  message and a button that opens the **main** bot's Mini App. The button is a **URL** to
+  the main bot's direct link (`TELEGRAM_BOT_LINK`, the same link the UI uses) with
+  `?startapp` — a `web_app` button would launch under the promo bot's identity (its token
+  would sign the initData), which the main bot's validator rejects. It is fully
+  self-contained: no bot-link, no gateway, no game.
 - **Rate limiting.** Outbound sends are throttled (`TELEGRAM_SEND_RATE_PER_SECOND`,
   default 25) to respect the Bot API flood limits.
 
@@ -57,7 +74,9 @@ parsing is Telegram-specific.
   gateway also implements `SendToUser` / `SendToGameChannel` as the backend's admin
   relay.
 - `pkg/proto/botlink/v1`, service `BotLink` — the reverse bidi stream the **bot** dials
-  on the gateway (`Hello` / `Command` / `Ack`). Generated Go is committed under `pkg`.
+  on the gateway (`Hello` / `Command` / `Ack`), now also carrying a `ChatGateCommand` (set
+  a user's chat write access) and a unary `ResolveChatEligibility` (the bot's join-time
+  query) over the same mTLS channel. Generated Go is committed under `pkg`.
 
 ## Deep-link scheme
 
@@ -101,6 +120,10 @@ Bot (`cmd/bot`):
 | `TELEGRAM_BOTLINK_SERVER_NAME` | — (required) | the gateway certificate's expected SNI / CN |
 | `TELEGRAM_BOTLINK_TLS_CERT` / `_KEY` / `_CA` | — (required) | the bot client cert, its key, and the CA that signs the gateway server cert |
 | `TELEGRAM_GAME_CHANNEL_ID` | — | the bot's game channel chat id for `SendToGameChannel` |
+| `TELEGRAM_CHAT_ID` | — | the moderated discussion chat id (a channel's linked group); empty disables chat gating |
+| `TELEGRAM_PROMO_BOT_TOKEN` | — | the optional standalone promo bot's token; empty disables it |
+| `TELEGRAM_BOT_USERNAME` | — | the main bot's @username without the @ (promo message); required when the promo bot runs |
+| `TELEGRAM_BOT_LINK` | — | the main bot's Mini App link for the promo button (the UI's `VITE_TELEGRAM_LINK`); required when the promo bot runs |
 | `TELEGRAM_OWNS_UPDATES` | `true` | run the exclusive `getUpdates` long-poll (one bot per token) |
 | `TELEGRAM_SEND_RATE_PER_SECOND` | `25` | outbound Bot API send cap (0 disables) |
 | `TELEGRAM_INSTANCE_ID` | hostname | bot identity reported to the gateway |