ci(deploy): auto-register Telegram webhook + commands after SAM deploy

Append two steps to .github/workflows/deploy.yml that POST setWebhook
and setMyCommands against the freshly-deployed Function URL, reading
credentials from SSM. Mirrors `make telegram-setup` but inlined to
avoid the Makefile's --profile admin assumption.

Token and webhook-secret are masked via ::add-mask:: before any echo.
Jobs fail loudly on Telegram API errors via `jq -e .ok`.

Mark the manual setWebhook snippets in docs/deploy-aws.md and
docs/deploy-aws-free-tier-guide.md as break-glass.

.github/workflows/deploy.yml

@@ -63,3 +63,49 @@ jobs:
             --output text)
           echo "FunctionUrl=$URL"
           curl -fsSL --max-time 30 "$URL/" | tee /tmp/smoke.json | jq .
+
+      - name: Register Telegram webhook
+        env:
+          STACK_ENV: prod
+        run: |
+          set -euo pipefail
+          URL=$(aws cloudformation describe-stacks \
+            --stack-name "$STACK_NAME" \
+            --query "Stacks[0].Outputs[?OutputKey=='FunctionUrl'].OutputValue" \
+            --output text)
+          TOKEN=$(aws ssm get-parameter \
+            --name "/miti99bot/${STACK_ENV}/telegram-bot-token" \
+            --with-decryption --query Parameter.Value --output text)
+          echo "::add-mask::$TOKEN"
+          SECRET=$(aws ssm get-parameter \
+            --name "/miti99bot/${STACK_ENV}/telegram-webhook-secret" \
+            --with-decryption --query Parameter.Value --output text)
+          echo "::add-mask::$SECRET"
+          WEBHOOK_URL="${URL%/}/webhook"
+          echo "Setting Telegram webhook to ${WEBHOOK_URL}"
+          RESP=$(curl -fsS --max-time 30 -X POST \
+            "https://api.telegram.org/bot${TOKEN}/setWebhook" \
+            -d "url=${WEBHOOK_URL}" \
+            -d "secret_token=${SECRET}" \
+            -d 'allowed_updates=["message","callback_query"]')
+          echo "$RESP" | jq -e '.ok == true' >/dev/null \
+            || { echo "setWebhook failed: $RESP"; exit 1; }
+          echo "$RESP" | jq '{ok, result, description}'
+
+      - name: Register Telegram command menu
+        env:
+          STACK_ENV: prod
+        run: |
+          set -euo pipefail
+          TOKEN=$(aws ssm get-parameter \
+            --name "/miti99bot/${STACK_ENV}/telegram-bot-token" \
+            --with-decryption --query Parameter.Value --output text)
+          echo "::add-mask::$TOKEN"
+          echo "Registering Telegram commands from aws/telegram-commands.json"
+          RESP=$(curl -fsS --max-time 30 -X POST \
+            "https://api.telegram.org/bot${TOKEN}/setMyCommands" \
+            -H 'Content-Type: application/json' \
+            --data-binary "@aws/telegram-commands.json")
+          echo "$RESP" | jq -e '.ok == true' >/dev/null \
+            || { echo "setMyCommands failed: $RESP"; exit 1; }
+          echo "$RESP" | jq '{ok, result, description}'