feat(account): seed the time zone from the client's detected offset at creation

A new account's time_zone defaulted to 'UTC' until the player saved a profile, so the
robot's sleep window and the turn-timeout away-window sweeper — both anchored to the
account zone via account.ResolveZone — ran on UTC for every fresh player, skewing
robot-game timing until a manual Settings save. Seed the zone at creation instead, from
the client's detected "±HH:MM" offset.

- Carry browser_tz on the three account-creating auth requests (TelegramLoginRequest,
  GuestLoginRequest, EmailRequestRequest — the email account is provisioned at the
  code-request step, not at login) through the fbs envelope (+ Go/TS codegen), the
  gateway transcode + backend client, and the backend auth handlers into
  ProvisionTelegram / ProvisionGuest / ProvisionEmail.
- create() now writes time_zone explicitly: the validated detected offset, or 'UTC'
  (equal to the column default) when absent or malformed — deterministic, never guessed.
  The column is already NOT NULL DEFAULT 'UTC', so no migration is needed and existing
  accounts keep 'UTC'. An existing account is never overwritten on re-login.
- A detected zero offset is stored as "+00:00" (the zone is known and equals UTC),
  distinct from the "UTC" default that means "unknown" — which the feedback console's
  three-zone Filed display already reflects.
- Guard the guest handler against an empty payload (the bootstrap historically carried
  none) so it degrades to no-seed rather than panicking in GetRootAs*.
- Tests: zone seeding across Telegram/guest/email plus the "+00:00"/malformed/empty
  cases and the not-overwrite rule; codec round-trip for the three auth encoders.
  ARCHITECTURE + FUNCTIONAL(+ru) updated.

ui/src/lib/codec.test.ts

@@ -19,13 +19,16 @@ import {
   decodeStateView,
   decodeStats,
   encodeCheckWord,
+  encodeEmailRequest,
   encodeFeedbackSubmit,
   encodeDraftSave,
   encodeEnqueue,
   encodeExchange,
+  encodeGuestLogin,
   encodeStateRequest,
   encodeSubmitPlay,
   encodeTarget,
+  encodeTelegramLogin,
   encodeUpdateProfile,
 } from './codec';
 
@@ -73,6 +76,26 @@ describe('codec', () => {
     });
   });
 
+  it('carries the detected browser zone on every account-creating auth request', () => {
+    const tg = fb.TelegramLoginRequest.getRootAsTelegramLoginRequest(
+      new ByteBuffer(encodeTelegramLogin('init-data-blob', '+03:00')),
+    );
+    expect(tg.initData()).toBe('init-data-blob');
+    expect(tg.browserTz()).toBe('+03:00');
+
+    const guest = fb.GuestLoginRequest.getRootAsGuestLoginRequest(
+      new ByteBuffer(encodeGuestLogin('ru', '-05:30')),
+    );
+    expect(guest.locale()).toBe('ru');
+    expect(guest.browserTz()).toBe('-05:30');
+
+    const email = fb.EmailRequestRequest.getRootAsEmailRequestRequest(
+      new ByteBuffer(encodeEmailRequest('a@example.com', '+00:00')),
+    );
+    expect(email.email()).toBe('a@example.com');
+    expect(email.browserTz()).toBe('+00:00');
+  });
+
   it('round-trips a feedback submit and decodes state + unread', () => {
     const att = new Uint8Array([1, 2, 3, 4]);
     const req = fb.FeedbackSubmitRequest.getRootAsFeedbackSubmitRequest(