Problem

After Telegram OAuth redirect, popup window with tgAuthResult didn't send data back to opener via postMessage. This caused "Telegram connection failed" error. Also, trial activation endpoint was failing with "public_key required" due to missing authorization header.

Changes

OAuth postMessage fix

• Add sendTgAuthResultToOpener() to @tonkeeper/core (shared between web and desktop)
• Use the function in web/desktop entry points to send auth result via postMessage
• Add comment explaining allowedHosts in vite.config.mts
• Add comment explaining why withCredentials = false in desktop telegram-widget.js (Electron manages cookies separately)

Trial activation fix

• Add authorization header to /api/v1/services/pro/trial endpoint
• Pass auth token from subscriptionService.getToken() to TiersService.activateTrial()

CI fix

• Migrate macOS runners from deprecated macos-13 to macos-15-intel (x64) and macos-latest (arm64/universal)

Status

• ✅ Web: tested, OAuth works
• ✅ Desktop: tested, OAuth works