feat: scaffold plug-n-play telegram bot on cloudflare workers

grammY-based bot with a module plugin system loaded from the MODULES env
var. Three command visibility levels (public/protected/private) share a
unified command namespace with conflict detection at registry build.

- 4 initial modules (util, wordle, loldle, misc); util fully implemented,
  others are stubs proving the plugin system end-to-end
- util: /info (chat/thread/sender ids) + /help (pure renderer over the
  registry, HTML parse mode, escapes user-influenced strings)
- KVStore interface with CFKVStore and a per-module prefixing factory;
  getJSON/putJSON convenience helpers; other backends drop in via one file
- Webhook at POST /webhook with secret-token validation via grammY's
  webhookCallback; no admin HTTP surface
- Post-deploy register script (npm run deploy = wrangler deploy && node
  --env-file=.env.deploy scripts/register.js) for setWebhook and
  setMyCommands; --dry-run flag for preview
- 56 vitest unit tests across 7 suites covering registry, db wrapper,
  dispatcher, help renderer, validators, and HTML escaper
- biome for lint + format; phased implementation plan under plans/

.env.deploy.example

@@ -0,0 +1,15 @@
+# Post-deploy registration env, consumed by `scripts/register.js` via
+# `node --env-file=.env.deploy`. Copy to .env.deploy (gitignored) and fill in.
+#
+# TELEGRAM_BOT_TOKEN + TELEGRAM_WEBHOOK_SECRET must match the values set via
+# `wrangler secret put` so the Worker and Telegram agree on the same secret.
+TELEGRAM_BOT_TOKEN=
+TELEGRAM_WEBHOOK_SECRET=
+
+# Public URL of the deployed Worker (no trailing slash). Known after the first
+# `wrangler deploy`. Example: https://miti99bot.your-subdomain.workers.dev
+WORKER_URL=
+
+# Same MODULES value as wrangler.toml [vars]. Duplicated here so the register
+# script can derive the public command list without parsing wrangler.toml.
+MODULES=util,wordle,loldle,misc