feat(cabinet): bulletproof Close button + kill the /login flash on the service-unavailable screen

Two Telegram-Mini-App follow-ups to the backend-unavailable screen:

- Reliable "Close" button (Telegram only) that actually EXITS the Mini App
  instead of routing back. closeTelegramApp() tries the legacy
  window.Telegram.WebApp.close() global (telegram-web-app.js), then the SDK
  closeMiniApp(), then the raw postEvent('web_app_close') — all emit the same
  close event, so it can't silently fail. Guarded so the first path never
  silently no-ops.
- Eliminate the flash of the /login page before the outage screen. On the
  bootstrap path (the app has never reached the backend) reportPossibleBackendDown()
  now flips the screen IMMEDIATELY and synchronously instead of waiting on the
  confirm probe, so the overlay is up before isLoading flips and /login can never
  paint uncovered. Add an eager checkBackendOnStartup() liveness ping at launch
  (parallel with auth) so even the no-stored-token / fresh-Telegram path that
  makes no early request shows the screen at once. The confirm-probe still guards
  already-loaded sessions from a one-off blip.

i18n close key added in ru/en/zh/fa.

src/api/health.ts

@@ -85,8 +85,18 @@ let confirmInFlight = false;
  * already shown.
  */
 export async function reportPossibleBackendDown(): Promise<void> {
-  if (confirmInFlight) return;
   if (useBlockingStore.getState().blockingType === 'backend_unavailable') return;
+  // During the INITIAL bootstrap (we've never reached the backend yet) the
+  // caller's failed request is itself the confirmation, so flip the screen
+  // IMMEDIATELY and synchronously. A deferred probe here would let the /login
+  // page paint for the ~probe duration before the outage screen — the "jump"
+  // we must avoid. Once the app has loaded, fall through to the confirm-probe so
+  // a one-off network blip can't blank a working session.
+  if (!everReachedBackend) {
+    useBlockingStore.getState().setBackendUnavailable();
+    return;
+  }
+  if (confirmInFlight) return;
   confirmInFlight = true;
   try {
     const reachable = await pingBackend();
@@ -97,3 +107,20 @@ export async function reportPossibleBackendDown(): Promise<void> {
     confirmInFlight = false;
   }
 }
+
+/**
+ * Eager liveness check fired once at app launch (from main.tsx), in parallel
+ * with auth bootstrap. If the backend is already down at launch this paints the
+ * ServiceUnavailableScreen immediately — before the auth flow can flash the
+ * /login page — even on the no-stored-token path that makes no early request.
+ * No-op if the app has already reached the backend or another blocking screen
+ * is showing.
+ */
+export async function checkBackendOnStartup(): Promise<void> {
+  if (everReachedBackend) return;
+  if (useBlockingStore.getState().blockingType !== null) return;
+  const reachable = await pingBackend();
+  if (!reachable && !everReachedBackend && useBlockingStore.getState().blockingType === null) {
+    useBlockingStore.getState().setBackendUnavailable();
+  }
+}