feat(account): seed the time zone from the client's detected offset at creation

A new account's time_zone defaulted to 'UTC' until the player saved a profile, so the
robot's sleep window and the turn-timeout away-window sweeper — both anchored to the
account zone via account.ResolveZone — ran on UTC for every fresh player, skewing
robot-game timing until a manual Settings save. Seed the zone at creation instead, from
the client's detected "±HH:MM" offset.

- Carry browser_tz on the three account-creating auth requests (TelegramLoginRequest,
  GuestLoginRequest, EmailRequestRequest — the email account is provisioned at the
  code-request step, not at login) through the fbs envelope (+ Go/TS codegen), the
  gateway transcode + backend client, and the backend auth handlers into
  ProvisionTelegram / ProvisionGuest / ProvisionEmail.
- create() now writes time_zone explicitly: the validated detected offset, or 'UTC'
  (equal to the column default) when absent or malformed — deterministic, never guessed.
  The column is already NOT NULL DEFAULT 'UTC', so no migration is needed and existing
  accounts keep 'UTC'. An existing account is never overwritten on re-login.
- A detected zero offset is stored as "+00:00" (the zone is known and equals UTC),
  distinct from the "UTC" default that means "unknown" — which the feedback console's
  three-zone Filed display already reflects.
- Guard the guest handler against an empty payload (the bootstrap historically carried
  none) so it degrades to no-seed rather than panicking in GetRootAs*.
- Tests: zone seeding across Telegram/guest/email plus the "+00:00"/malformed/empty
  cases and the not-overwrite rule; codec round-trip for the three auth encoders.
  ARCHITECTURE + FUNCTIONAL(+ru) updated.

ui/src/gen/fbs/scrabblefb/email-request-request.ts

@@ -27,22 +27,34 @@ email(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+browserTz():string|null
+browserTz(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+browserTz(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startEmailRequestRequest(builder:flatbuffers.Builder) {
-  builder.startObject(1);
+  builder.startObject(2);
 }
 
 static addEmail(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset) {
   builder.addFieldOffset(0, emailOffset, 0);
 }
 
+static addBrowserTz(builder:flatbuffers.Builder, browserTzOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, browserTzOffset, 0);
+}
+
 static endEmailRequestRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createEmailRequestRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createEmailRequestRequest(builder:flatbuffers.Builder, emailOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset):flatbuffers.Offset {
   EmailRequestRequest.startEmailRequestRequest(builder);
   EmailRequestRequest.addEmail(builder, emailOffset);
+  EmailRequestRequest.addBrowserTz(builder, browserTzOffset);
   return EmailRequestRequest.endEmailRequestRequest(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/guest-login-request.ts

@@ -27,22 +27,34 @@ locale(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+browserTz():string|null
+browserTz(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+browserTz(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startGuestLoginRequest(builder:flatbuffers.Builder) {
-  builder.startObject(1);
+  builder.startObject(2);
 }
 
 static addLocale(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset) {
   builder.addFieldOffset(0, localeOffset, 0);
 }
 
+static addBrowserTz(builder:flatbuffers.Builder, browserTzOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, browserTzOffset, 0);
+}
+
 static endGuestLoginRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createGuestLoginRequest(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createGuestLoginRequest(builder:flatbuffers.Builder, localeOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset):flatbuffers.Offset {
   GuestLoginRequest.startGuestLoginRequest(builder);
   GuestLoginRequest.addLocale(builder, localeOffset);
+  GuestLoginRequest.addBrowserTz(builder, browserTzOffset);
   return GuestLoginRequest.endGuestLoginRequest(builder);
 }
 }

ui/src/gen/fbs/scrabblefb/telegram-login-request.ts

@@ -27,22 +27,34 @@ initData(optionalEncoding?:any):string|Uint8Array|null {
   return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
 }
 
+browserTz():string|null
+browserTz(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+browserTz(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
 static startTelegramLoginRequest(builder:flatbuffers.Builder) {
-  builder.startObject(1);
+  builder.startObject(2);
 }
 
 static addInitData(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset) {
   builder.addFieldOffset(0, initDataOffset, 0);
 }
 
+static addBrowserTz(builder:flatbuffers.Builder, browserTzOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, browserTzOffset, 0);
+}
+
 static endTelegramLoginRequest(builder:flatbuffers.Builder):flatbuffers.Offset {
   const offset = builder.endObject();
   return offset;
 }
 
-static createTelegramLoginRequest(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset):flatbuffers.Offset {
+static createTelegramLoginRequest(builder:flatbuffers.Builder, initDataOffset:flatbuffers.Offset, browserTzOffset:flatbuffers.Offset):flatbuffers.Offset {
   TelegramLoginRequest.startTelegramLoginRequest(builder);
   TelegramLoginRequest.addInitData(builder, initDataOffset);
+  TelegramLoginRequest.addBrowserTz(builder, browserTzOffset);
   return TelegramLoginRequest.endTelegramLoginRequest(builder);
 }
 }

ui/src/lib/codec.test.ts

@@ -19,13 +19,16 @@ import {
   decodeStateView,
   decodeStats,
   encodeCheckWord,
+  encodeEmailRequest,
   encodeFeedbackSubmit,
   encodeDraftSave,
   encodeEnqueue,
   encodeExchange,
+  encodeGuestLogin,
   encodeStateRequest,
   encodeSubmitPlay,
   encodeTarget,
+  encodeTelegramLogin,
   encodeUpdateProfile,
 } from './codec';
 
@@ -73,6 +76,26 @@ describe('codec', () => {
     });
   });
 
+  it('carries the detected browser zone on every account-creating auth request', () => {
+    const tg = fb.TelegramLoginRequest.getRootAsTelegramLoginRequest(
+      new ByteBuffer(encodeTelegramLogin('init-data-blob', '+03:00')),
+    );
+    expect(tg.initData()).toBe('init-data-blob');
+    expect(tg.browserTz()).toBe('+03:00');
+
+    const guest = fb.GuestLoginRequest.getRootAsGuestLoginRequest(
+      new ByteBuffer(encodeGuestLogin('ru', '-05:30')),
+    );
+    expect(guest.locale()).toBe('ru');
+    expect(guest.browserTz()).toBe('-05:30');
+
+    const email = fb.EmailRequestRequest.getRootAsEmailRequestRequest(
+      new ByteBuffer(encodeEmailRequest('a@example.com', '+00:00')),
+    );
+    expect(email.email()).toBe('a@example.com');
+    expect(email.browserTz()).toBe('+00:00');
+  });
+
   it('round-trips a feedback submit and decodes state + unread', () => {
     const att = new Uint8Array([1, 2, 3, 4]);
     const req = fb.FeedbackSubmitRequest.getRootAsFeedbackSubmitRequest(

ui/src/lib/codec.ts

@@ -179,27 +179,33 @@ export function encodeChatPost(gameId: string, body: string): Uint8Array {
   return finish(b, fb.ChatPostRequest.endChatPostRequest(b));
 }
 
-export function encodeTelegramLogin(initData: string): Uint8Array {
+export function encodeTelegramLogin(initData: string, browserTz: string): Uint8Array {
   const b = new Builder(512);
   const d = b.createString(initData);
+  const tz = b.createString(browserTz);
   fb.TelegramLoginRequest.startTelegramLoginRequest(b);
   fb.TelegramLoginRequest.addInitData(b, d);
+  fb.TelegramLoginRequest.addBrowserTz(b, tz);
   return finish(b, fb.TelegramLoginRequest.endTelegramLoginRequest(b));
 }
 
-export function encodeGuestLogin(locale: string): Uint8Array {
+export function encodeGuestLogin(locale: string, browserTz: string): Uint8Array {
   const b = new Builder(64);
   const l = b.createString(locale);
+  const tz = b.createString(browserTz);
   fb.GuestLoginRequest.startGuestLoginRequest(b);
   fb.GuestLoginRequest.addLocale(b, l);
+  fb.GuestLoginRequest.addBrowserTz(b, tz);
   return finish(b, fb.GuestLoginRequest.endGuestLoginRequest(b));
 }
 
-export function encodeEmailRequest(email: string): Uint8Array {
+export function encodeEmailRequest(email: string, browserTz: string): Uint8Array {
   const b = new Builder(128);
   const e = b.createString(email);
+  const tz = b.createString(browserTz);
   fb.EmailRequestRequest.startEmailRequestRequest(b);
   fb.EmailRequestRequest.addEmail(b, e);
+  fb.EmailRequestRequest.addBrowserTz(b, tz);
   return finish(b, fb.EmailRequestRequest.endEmailRequestRequest(b));
 }
 

ui/src/lib/transport.ts

@@ -63,13 +63,13 @@ export function createTransport(baseUrl: string): GatewayClient {
     },
 
     async authTelegram(initData) {
-      return codec.decodeSession(await exec('auth.telegram', codec.encodeTelegramLogin(initData)));
+      return codec.decodeSession(await exec('auth.telegram', codec.encodeTelegramLogin(initData, browserOffset())));
     },
     async authGuest(locale) {
-      return codec.decodeSession(await exec('auth.guest', codec.encodeGuestLogin(locale ?? '')));
+      return codec.decodeSession(await exec('auth.guest', codec.encodeGuestLogin(locale ?? '', browserOffset())));
     },
     async authEmailRequest(email) {
-      await exec('auth.email.request', codec.encodeEmailRequest(email));
+      await exec('auth.email.request', codec.encodeEmailRequest(email, browserOffset()));
     },
     async authEmailLogin(email, code) {
       return codec.decodeSession(await exec('auth.email.login', codec.encodeEmailLogin(email, code)));