feat(cabinet): bulletproof Close button + kill the /login flash on the service-unavailable screen

Two Telegram-Mini-App follow-ups to the backend-unavailable screen:

- Reliable "Close" button (Telegram only) that actually EXITS the Mini App
  instead of routing back. closeTelegramApp() tries the legacy
  window.Telegram.WebApp.close() global (telegram-web-app.js), then the SDK
  closeMiniApp(), then the raw postEvent('web_app_close') — all emit the same
  close event, so it can't silently fail. Guarded so the first path never
  silently no-ops.
- Eliminate the flash of the /login page before the outage screen. On the
  bootstrap path (the app has never reached the backend) reportPossibleBackendDown()
  now flips the screen IMMEDIATELY and synchronously instead of waiting on the
  confirm probe, so the overlay is up before isLoading flips and /login can never
  paint uncovered. Add an eager checkBackendOnStartup() liveness ping at launch
  (parallel with auth) so even the no-stored-token / fresh-Telegram path that
  makes no early request shows the screen at once. The confirm-probe still guards
  already-loaded sessions from a one-off blip.

i18n close key added in ru/en/zh/fa.

src/hooks/useTelegramSDK.ts

@@ -15,6 +15,8 @@ import {
   retrieveLaunchParams,
   retrieveRawInitData,
   themeParamsState,
+  closeMiniApp as sdkCloseMiniApp,
+  postEvent,
 } from '@telegram-apps/sdk-react';
 
 const FULLSCREEN_CACHE_KEY = 'cabinet_fullscreen_enabled';
@@ -50,6 +52,34 @@ export function isInTelegramWebApp(): boolean {
   return detectTelegram();
 }
 
+/**
+ * Closes the Telegram Mini App as reliably as possible. All three paths emit the
+ * same `web_app_close` event to the Telegram client; we try the most broadly
+ * compatible first and stop at the first that doesn't throw:
+ *   1) the legacy `window.Telegram.WebApp.close()` global (telegram-web-app.js,
+ *      loaded in index.html) — widest client coverage, no SDK-mount dependency;
+ *   2) the modern SDK `closeMiniApp()` (mini app is mounted on init);
+ *   3) the raw `postEvent('web_app_close')` protocol event — no global/mount
+ *      dependency at all.
+ * Outside Telegram it is a safe no-op.
+ */
+export function closeTelegramApp(): void {
+  try {
+    const wa = window.Telegram?.WebApp;
+    if (wa?.close) {
+      wa.close();
+      return;
+    }
+  } catch {}
+  try {
+    sdkCloseMiniApp();
+    return;
+  } catch {}
+  try {
+    postEvent('web_app_close');
+  } catch {}
+}
+
 export function isTelegramMobile(): boolean {
   try {
     const { tgWebAppPlatform } = retrieveLaunchParams();