feat: add Telegram account linking UI with CSRF protection

- TelegramLinkWidget component with Login Widget for browser users
- One-click initData linking for Mini App users
- LinkTelegramCallback page with CSRF state validation
- URL credential clearing via history.replaceState
- Merge flow support with replace navigation
- i18n keys for all 4 locales (ru, en, zh, fa)

src/api/auth.ts

@@ -233,6 +233,27 @@ export const authApi = {
     return response.data;
   },
 
+  // Link Telegram account (Mini App initData or Login Widget data)
+  linkTelegram: async (
+    data:
+      | { init_data: string }
+      | {
+          id: number;
+          first_name: string;
+          last_name?: string;
+          username?: string;
+          photo_url?: string;
+          auth_date: number;
+          hash: string;
+        },
+  ): Promise<LinkCallbackResponse> => {
+    const response = await apiClient.post<LinkCallbackResponse>(
+      '/cabinet/auth/account/link/telegram',
+      data,
+    );
+    return response.data;
+  },
+
   unlinkProvider: async (provider: string): Promise<{ success: boolean }> => {
     const response = await apiClient.post<{ success: boolean }>(
       `/cabinet/auth/account/unlink/${encodeURIComponent(provider)}`,