Outcome

Implements WEB-02: a Go same-origin Web BFF for Telegram OIDC Authorization Code + PKCE, backed by revocable YDB sessions and explicit tenant membership authorization.

What changed

• added the Telegram OIDC adapter with exact production endpoints, RS256/JWKS validation, bounded caching, PKCE, nonce, issuer, audience, and time-claim checks;
• added a local-only Go OIDC fixture that refuses cloud environments;
• added one-time browser-bound login challenges, immutable external-identity mapping, memberships, invitations, revocable Web sessions, tenant rotation, and audited cloud-dev bootstrap persistence in YDB;
• materialized the Telegram external identity and owner membership during normal Telegram identity ingestion;
• added secure __Host- cookies, exact-Origin + CSRF mutation checks, logout, identity, tenant-list, and active-tenant routes;
• enabled YDB automatic size/load partitioning without fixing physical partition counts;
• documented runtime configuration, secret injection, data access paths, bootstrap, and verification.

Verification

• make ci
• go test -race -count=50 -run TestLoginTenantSwitchCSRFAndLogout ./internal/webbff
• tagged YDB integration package compilation
• git diff --check
• public documentation contains no Cyrillic

Local YDB execution is not claimed because the workstation cannot access the Colima Docker socket. The mandatory mirrored GitHub Actions YDB job must apply all migrations twice and run the concurrency/isolation suite before merge.

Closes #31.