fix: referral system — stop cabinet redirect to Telegram, fix deep link code handling

- Remove redirect to Telegram bot when email auth disabled + referral code present
  (cabinet links should stay on cabinet, bot links should go to bot)
- Remove referral_code from deep link auth (existing users can't get referrals)
- Don't consume referralCode in deep link path — leave it in localStorage for
  OIDC/widget auth methods that actually send it to the backend
- Consume campaign slug once into ref to survive retries (codesConsumedRef pattern)
- Update loginWithDeepLink to only accept (token, campaignSlug) — no referralCode
- Update pollDeepLinkToken API to match backend schema change

src/components/TelegramLoginButton.tsx

@@ -6,6 +6,7 @@ import { brandingApi, type TelegramWidgetConfig } from '../api/branding';
 import { authApi } from '../api/auth';
 import { useAuthStore } from '../store/auth';
 import { useNavigate } from 'react-router';
+import { consumeCampaignSlug } from '../utils/campaign';
 
 interface TelegramLoginButtonProps {
   referralCode?: string;
@@ -34,6 +35,10 @@ export default function TelegramLoginButton({ referralCode }: TelegramLoginButto
 
   const loginWithDeepLink = useAuthStore((s) => s.loginWithDeepLink);
 
+  // Capture campaign slug once on mount (before any retry clears it)
+  const capturedCampaignRef = useRef<string | null>(null);
+  const codesConsumedRef = useRef(false);
+
   const { data: widgetConfig } = useQuery<TelegramWidgetConfig>({
     queryKey: ['telegram-widget-config'],
     queryFn: brandingApi.getTelegramWidgetConfig,
@@ -239,6 +244,17 @@ export default function TelegramLoginButton({ referralCode }: TelegramLoginButto
     }
 
     try {
+      // Consume campaign slug ONCE (first call only).
+      // Clears localStorage on first call, so subsequent retries reuse the ref.
+      // Note: referral code is NOT consumed here — deep link auth is for existing
+      // bot users where referrals don't apply. Leaving it in localStorage allows
+      // other auth methods (OIDC, widget) to pick it up if the user switches paths.
+      if (!codesConsumedRef.current) {
+        capturedCampaignRef.current = consumeCampaignSlug();
+        codesConsumedRef.current = true;
+      }
+      const capturedCampaign = capturedCampaignRef.current;
+
       const response = await authApi.requestDeepLinkToken();
       const { token, bot_username, expires_in } = response;
       setDeepLinkToken(token);
@@ -249,7 +265,8 @@ export default function TelegramLoginButton({ referralCode }: TelegramLoginButto
       const poll = async () => {
         if (!mountedRef.current) return;
         try {
-          await loginWithDeepLink(token);
+          // Deep link auth is for existing bot users — only campaign_slug applies
+          await loginWithDeepLink(token, capturedCampaign);
           // Success — auth store is updated, navigate
           if (expireTimeoutRef.current) {
             clearTimeout(expireTimeoutRef.current);