feat(telegram): promo bot + channel-chat moderation gate

Add a second standalone promo bot to the bot container (answers /start with a
localized message + a URL button into the main bot's Mini App) and gate write
access in a channel's linked discussion chat: grant on join when the Telegram
user is registered and neither admin-suspended nor holding a new chat_muted
role, and revoke/grant on the matching moderation change for a member currently
in the chat.

Eligibility (registered AND NOT suspended AND NOT chat_muted; the game
suspension dominates) is resolved once in the backend and reached two ways: the
bot's join-time unary ResolveChatEligibility over the existing mTLS bot-link,
and a backend chat_access_changed event -> gateway -> ChatGate command
(idempotent; a temporary-block-expiry sweeper may over-emit). The bot guards the
block/unblock path with getChatMember, since bots cannot list members.

A web_app button cannot open another bot's Mini App (it signs initData with the
sending bot's token), so the promo button is a t.me ?startapp URL reusing the
UI's VITE_TELEGRAM_LINK. The bot must be a chat admin with the restrict-members
right and chat_member in its allowed updates.

No schema change: chat_muted reuses the data-driven account_roles table.

platform/telegram/internal/botlink/client.go

@@ -37,27 +37,25 @@ type ClientConfig struct {
 }
 
 // Client maintains the long-lived bot-link to the gateway, executing the commands
-// it receives and re-dialing after any break.
+// it receives and re-dialing after any break. The same mTLS connection also serves
+// the unary chat-eligibility query the bot makes on a chat join.
 type Client struct {
-	cfg  ClientConfig
-	exec *Executor
-	log  *zap.Logger
+	cfg    ClientConfig
+	exec   *Executor
+	log    *zap.Logger
+	conn   *grpc.ClientConn
+	client botlinkv1.BotLinkClient
 }
 
-// NewClient builds the bot-link client over the executor.
-func NewClient(cfg ClientConfig, exec *Executor, log *zap.Logger) *Client {
+// NewClient builds the bot-link client over the executor, dialing the gateway. The
+// gRPC connection is lazy, so the dial does not block on the gateway being up; the
+// caller must Close it. The bot-link command stream is opened by Run.
+func NewClient(cfg ClientConfig, exec *Executor, log *zap.Logger) (*Client, error) {
 	if log == nil {
 		log = zap.NewNop()
 	}
-	return &Client{cfg: cfg, exec: exec, log: log}
-}
-
-// Run dials the gateway and keeps the bot-link open, re-dialing after each break,
-// until ctx is cancelled. The gRPC connection auto-reconnects the transport; this
-// loop re-opens the Link stream on top of it.
-func (c *Client) Run(ctx context.Context) error {
-	conn, err := grpc.NewClient(c.cfg.GatewayAddr,
-		grpc.WithTransportCredentials(c.cfg.Creds),
+	conn, err := grpc.NewClient(cfg.GatewayAddr,
+		grpc.WithTransportCredentials(cfg.Creds),
 		grpc.WithStatsHandler(otelgrpc.NewClientHandler()),
 		grpc.WithKeepaliveParams(keepalive.ClientParameters{
 			Time:                clientKeepaliveTime,
@@ -66,13 +64,30 @@ func (c *Client) Run(ctx context.Context) error {
 		}),
 	)
 	if err != nil {
-		return err
+		return nil, err
 	}
-	defer func() { _ = conn.Close() }()
-	client := botlinkv1.NewBotLinkClient(conn)
+	return &Client{cfg: cfg, exec: exec, log: log, conn: conn, client: botlinkv1.NewBotLinkClient(conn)}, nil
+}
 
+// Close releases the bot-link connection.
+func (c *Client) Close() error { return c.conn.Close() }
+
+// ResolveChatEligibility asks the gateway whether the Telegram user identified by
+// externalID may write in the moderated chat. The bot calls it on a chat join, over
+// the same mTLS connection as the command stream.
+func (c *Client) ResolveChatEligibility(ctx context.Context, externalID string) (bool, error) {
+	resp, err := c.client.ResolveChatEligibility(ctx, &botlinkv1.ChatEligibilityRequest{ExternalId: externalID})
+	if err != nil {
+		return false, err
+	}
+	return resp.GetEligible(), nil
+}
+
+// Run keeps the bot-link command stream open, re-opening it after each break, until
+// ctx is cancelled. The gRPC connection auto-reconnects the transport underneath.
+func (c *Client) Run(ctx context.Context) error {
 	for ctx.Err() == nil {
-		if err := c.serve(ctx, client); err != nil && ctx.Err() == nil {
+		if err := c.serve(ctx, c.client); err != nil && ctx.Err() == nil {
 			c.log.Warn("bot-link stream ended", zap.Error(err))
 		}
 		if !sleep(ctx, c.cfg.ReconnectDelay) {