feat: scaffold plug-n-play telegram bot on cloudflare workers

grammY-based bot with a module plugin system loaded from the MODULES env
var. Three command visibility levels (public/protected/private) share a
unified command namespace with conflict detection at registry build.

- 4 initial modules (util, wordle, loldle, misc); util fully implemented,
  others are stubs proving the plugin system end-to-end
- util: /info (chat/thread/sender ids) + /help (pure renderer over the
  registry, HTML parse mode, escapes user-influenced strings)
- KVStore interface with CFKVStore and a per-module prefixing factory;
  getJSON/putJSON convenience helpers; other backends drop in via one file
- Webhook at POST /webhook with secret-token validation via grammY's
  webhookCallback; no admin HTTP surface
- Post-deploy register script (npm run deploy = wrangler deploy && node
  --env-file=.env.deploy scripts/register.js) for setWebhook and
  setMyCommands; --dry-run flag for preview
- 56 vitest unit tests across 7 suites covering registry, db wrapper,
  dispatcher, help renderer, validators, and HTML escaper
- biome for lint + format; phased implementation plan under plans/

scripts/stub-kv.js

@@ -0,0 +1,35 @@
+/**
+ * @file stub-kv — minimal no-op KVNamespace stub used by scripts/register.js.
+ *
+ * The register script imports buildRegistry() to derive the public command
+ * list at deploy time. buildRegistry calls createStore() → CFKVStore → needs
+ * a KV binding. This stub satisfies the shape without doing any real IO,
+ * since module init hooks in this codebase read-only (or tolerate missing
+ * state). If a future module writes inside init(), update the stub to
+ * swallow writes or gate the write on a `process.env.REGISTER_DRYRUN` flag.
+ */
+
+/** @type {KVNamespace} */
+export const stubKv = {
+  async get() {
+    return null;
+  },
+  async put() {
+    // no-op
+  },
+  async delete() {
+    // no-op
+  },
+  async list() {
+    return {
+      keys: [],
+      list_complete: true,
+      cursor: undefined,
+    };
+  },
+  // getWithMetadata is part of the KVNamespace type but unused by CFKVStore
+  // — provide a stub so duck-typing doesn't trip.
+  async getWithMetadata() {
+    return { value: null, metadata: null };
+  },
+};