Add full system audit reports and Telegram Mini App debug handoff

- Three-stream audit (security / logic / performance) with 35+ findings
  derived from actual source code, each with file:line and remediation
- Audit Index cross-references criticals across streams into prioritized
  fix tiers: immediately / before soft launch / before public launch
- Telegram Mini App debug handoff documenting what was implemented and
  all remaining work items with exact file lists and test commands
- Updated architecture, data model, auth API, and registration flow docs
  to reflect Telegram auth, TON wallet, and email verification additions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

04 - Flows/Registration Flow.md

@@ -179,11 +179,14 @@ sequenceDiagram
 
 ## Linked flows
 
-- [[Authentication Flow]] — the next time the user signs in.
+- [[Authentication Flow]] — the next time the user signs in (includes the Telegram first-class auth section).
 - [[Referral Flow]] — full points-awarding mechanics triggered here.
 - [[Google OAuth Flow]] — alternative path that bypasses `TempVerification` (Google identities are pre-verified).
 - [[Password Reset Flow]] — if the user forgets the password they set during verification.
 
+> [!tip] Telegram — zero-step registration
+> Users who open the Amanat Telegram Mini App do **not** go through this flow at all. `POST /api/auth/telegram` verifies the Telegram-signed `initData` and auto-provisions a new `User` (no email, `authProvider: "telegram"`) in a single round-trip. The `TempVerification` + email code cycle only applies to email-based sign-ups. See [[Authentication Flow#Telegram first-class auth flow]].
+
 ## Source files
 
 - Backend: `backend/src/services/auth/authController.ts:33-158` (register), `:364-469` (verify), `:498-539` (resend)