feat: add Telegram account linking UI with CSRF protection

- TelegramLinkWidget component with Login Widget for browser users
- One-click initData linking for Mini App users
- LinkTelegramCallback page with CSRF state validation
- URL credential clearing via history.replaceState
- Merge flow support with replace navigation
- i18n keys for all 4 locales (ru, en, zh, fa)

src/App.tsx

@@ -41,6 +41,7 @@ const TopUpMethodSelect = lazy(() => import('./pages/TopUpMethodSelect'));
 const TopUpAmount = lazy(() => import('./pages/TopUpAmount'));
 const ConnectedAccounts = lazy(() => import('./pages/ConnectedAccounts'));
 const LinkOAuthCallback = lazy(() => import('./pages/LinkOAuthCallback'));
+const LinkTelegramCallback = lazy(() => import('./pages/LinkTelegramCallback'));
 const MergeAccounts = lazy(() => import('./pages/MergeAccounts'));
 
 // Admin pages - lazy load (only for admins)
@@ -326,6 +327,16 @@ function App() {
             </ProtectedRoute>
           }
         />
+        <Route
+          path="/auth/link/telegram/callback"
+          element={
+            <ProtectedRoute>
+              <LazyPage>
+                <LinkTelegramCallback />
+              </LazyPage>
+            </ProtectedRoute>
+          }
+        />
         <Route
           path="/contests"
           element={