Stage 15: dual Telegram bots & language-gated variants

Service-agnostic refinement of the owner's idea: the sign-in service returns a
set of supported game languages with the user identity, and the lobby gates the
New Game variant choice by it (en -> English; ru -> Russian + Эрудит).

- Connector hosts two bots in one container (one per service language, each its
  own token + game channel; the same telegram_id spans both). ValidateInitData
  tries each token and returns the validating bot's service_language +
  supported_languages. Per-language config (TELEGRAM_BOT_TOKEN_EN/_RU, channels).
- supported_languages rides the Session (fbs, session-scoped, not persisted); the
  UI offers only the matching variants on New Game — gating only the START of a
  new game (auto-match + friend invite), not accept/open/play; backend does not
  enforce.
- service_language persisted (accounts.service_language, migration 00010, written
  every login, last-login-wins) and routes the user-facing Notify push back
  through the right bot (push-target coalesces with preferred_language).
- Admin SendToUser/SendToGameChannel gain an operator-chosen language selector in
  the console (unrelated to ValidateInitData).
- Non-Telegram logins carry the gateway default set
  (GATEWAY_DEFAULT_SUPPORTED_LANGUAGES, all variants).

Wire (committed regen): ValidateInitDataResponse +service_language
+supported_languages; Session +supported_languages; SendToUser/SendToGameChannel
+language. Docs (ARCHITECTURE/FUNCTIONAL/_ru/READMEs) + PLAN updated; stage marked done.

gateway/internal/transcode/transcode_telegram_test.go

@@ -47,7 +47,7 @@ func TestTelegramAuthForwardsSeedFields(t *testing.T) {
 	})
 	defer cleanup()
 
-	v := fakeValidator{user: connector.User{ExternalID: "42", Username: "neo", FirstName: "Иван", LanguageCode: "ru"}}
+	v := fakeValidator{user: connector.User{ExternalID: "42", Username: "neo", FirstName: "Иван", LanguageCode: "ru", ServiceLanguage: "ru", SupportedLanguages: []string{"ru"}}}
 	reg := transcode.NewRegistry(backend, v)
 	op, ok := reg.Lookup(transcode.MsgAuthTelegram)
 	if !ok {
@@ -62,9 +62,43 @@ func TestTelegramAuthForwardsSeedFields(t *testing.T) {
 	if string(sess.Token()) != "tok-tg" || string(sess.UserId()) != "u-tg" {
 		t.Fatalf("session decoded wrong: token=%q user=%q", sess.Token(), sess.UserId())
 	}
-	// The validated launch fields are forwarded so the backend can seed a new account.
-	if gotBody["external_id"] != "42" || gotBody["language_code"] != "ru" || gotBody["first_name"] != "Иван" {
-		t.Errorf("forwarded body = %+v, want external_id=42 language_code=ru first_name=Иван", gotBody)
+	// The validating bot's supported languages ride the Session so the UI gates the
+	// New Game variant choice (here: ru -> Russian + Эрудит only).
+	if got := sessionLanguages(sess); len(got) != 1 || got[0] != "ru" {
+		t.Errorf("session supported_languages = %v, want [ru]", got)
+	}
+	// The validated launch fields are forwarded so the backend can seed a new account;
+	// service_language is recorded to route the account's later out-of-app push.
+	if gotBody["external_id"] != "42" || gotBody["language_code"] != "ru" || gotBody["first_name"] != "Иван" || gotBody["service_language"] != "ru" {
+		t.Errorf("forwarded body = %+v, want external_id=42 language_code=ru first_name=Иван service_language=ru", gotBody)
+	}
+}
+
+// sessionLanguages reads the supported_languages vector off a decoded Session.
+func sessionLanguages(s *fb.Session) []string {
+	out := make([]string, s.SupportedLanguagesLength())
+	for i := range out {
+		out[i] = string(s.SupportedLanguages(i))
+	}
+	return out
+}
+
+// TestGuestAuthSeedsDefaultLanguages confirms a non-platform (guest) session carries
+// the gateway's default supported-languages set, so the web client is ungated.
+func TestGuestAuthSeedsDefaultLanguages(t *testing.T) {
+	backend, cleanup := fakeBackend(t, func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"token":"tok-g","user_id":"u-g","is_guest":true,"display_name":"Guest"}`))
+	})
+	defer cleanup()
+
+	reg := transcode.NewRegistry(backend, nil, "en", "ru")
+	op, _ := reg.Lookup(transcode.MsgAuthGuest)
+	payload, err := op.Handler(context.Background(), transcode.Request{})
+	if err != nil {
+		t.Fatalf("handler: %v", err)
+	}
+	if got := sessionLanguages(fb.GetRootAsSession(payload, 0)); len(got) != 2 || got[0] != "en" || got[1] != "ru" {
+		t.Errorf("guest session supported_languages = %v, want [en ru]", got)
 	}
 }