Stage 9: Telegram integration (connector side-service, Mini App, out-of-app push)

New platform/telegram connector (own container, bot token only there):
- go-telegram/bot long-poll loop: /start deep-links + Mini App launch button.
- gRPC API pkg/proto/telegram/v1 (Telegram service): ValidateInitData, Notify
  (renders a localized message + deep-link button), SendToUser/SendToGameChannel
  (admin, wired in Stage 10). Generic methods are platform-agnostic (external_id).
- Bot API base override for Telegram's test environment; Dockerfile + compose
  (VPN sidecar, no public ingress); README.

Gateway:
- initData validation relocated from the gateway into the connector; the gateway
  calls ValidateInitData over gRPC (GATEWAY_CONNECTOR_ADDR), drops the bot token,
  and deletes internal/auth.
- Out-of-app push: runPushPump routes events whose recipient has no live in-app
  stream to connector.Notify, gated by /internal/push-target + the in-app-only
  flag (race-free de-dup); HasSubscribers added to the push hub.

Backend:
- Migration 00007 accounts.notifications_in_app_only (default true) + jetgen.
- ProvisionTelegram seeds a new account's language/display name from the launch
  fields; IdentityExternalID reverse lookup; /internal/push-target handler.

UI:
- Telegram Mini App launch: detect initData, apply themeParams, authTelegram,
  route the deep-link start_param (g/i/f); /telegram/ guard redirects outside
  Telegram. Vite relative base + telegram-web-app.js. In-app-only profile toggle;
  share-to-Telegram link for a friend code. Vitest + Playwright coverage.

Wire/docs/CI: fbs Profile/UpdateProfileRequest gain notifications_in_app_only
(Go + TS); go.work uses ./platform/telegram; go-unit.yaml covers it; PLAN,
ARCHITECTURE, FUNCTIONAL (+ru), UI_DESIGN, READMEs updated.

PLAN.md

@@ -682,6 +682,16 @@ Open details: deployment target/host; dashboards; load expectations.
   - **Stage 10 forward-note**: the admin surface will wire `connector.SendToUser`/
     `SendToGameChannel` (backend gains its own connector client) for operator
     broadcasts to a user and the game channel.
+  - **Verification-time fixes** (caught by the CI gate): (1) the gateway transcode
+    dropped `notifications_in_app_only` in four places (`ProfileResp`, `encodeProfile`,
+    `profileUpdateHandler`, the `UpdateProfile` body) so the toggle never reached the
+    backend — fixed, with a round-trip transcode test added. (2) The e2e suite was made
+    **hermetic** (a shared `ui/e2e/fixtures.ts` blocks the real `telegram-web-app.js`):
+    the render-blocking CDN `<script>` hung every page load on the CI runner, where
+    telegram.org is unreachable, timing out all non-Telegram specs. (3) A pre-existing
+    time-of-day flake in `TestTimeoutSweep` (the default 00:00–07:00 away window made
+    the sweeper skip when CI ran with `now-1h` inside it) was made deterministic by
+    clearing the test account's away window.
 
 ## Deferred TODOs (cross-stage)
 

backend/internal/inttest/game_test.go

@@ -312,6 +312,13 @@ func TestTimeoutSweep(t *testing.T) {
 	}
 	backdate(t, g.ID, time.Now().UTC().Add(-2*time.Hour))
 
+	// Disable the to-move account's away window: with the default 00:00–07:00
+	// window the sweeper (correctly) declines to time out a player whose deadline
+	// fell while they were asleep, which made this test fail whenever CI ran with
+	// now-1h inside that window (e.g. ~07:00 UTC). An empty window keeps the test
+	// deterministic regardless of the time of day.
+	setAway(t, seats[0], "UTC", "00:00", "00:00")
+
 	// The sweep is global over the shared pool; assert the target game itself,
 	// not the count, since other tests leave active games behind.
 	if n, err := svc.SweepTimeouts(ctx, time.Now().UTC()); err != nil || n < 1 {