feat: Docker audit + Telegram bot service + send UI

Docker:
- Harden docker-compose.yml: parameterized DB creds, required AUTH_SECRET,
  health checks, resource limits, network isolation, removed exposed DB port
- Add profiles (telegram/bot/full) so base 'docker compose up' needs only AUTH_SECRET
- Fix docker-entrypoint.sh: AUTH_SECRET startup guard
- Fix Dockerfile: copy prisma.config.ts + dotenv into production image
- Update .env.example with all new variables
- Update .dockerignore

Telegram Bot Service (bot/):
- TDLib-based bot using bot token auth (not HTTP Bot API)
- Commands: /search, /latest, /package, /link, /unlink, /subscribe, /unsubscribe
- pg_notify listener for send requests (bot_send) and new packages (new_package)
- Subscription-based notifications when matching packages arrive
- Dockerfile with multi-stage build (bookworm-slim for glibc/TDLib)

API & Database:
- Prisma: TelegramLink, BotSendRequest, BotSubscription models + migration
- POST /api/telegram/bot/send - queue package delivery to linked TG account
- GET /api/telegram/bot/send/[id] - poll send request status
- Server actions: generateTelegramLinkCode, unlinkTelegram, getBotSendHistory
- Worker: emit pg_notify('new_package') after creating packages

Frontend:
- Settings: TelegramLinkCard for account linking via one-time code
- STL table + drawer: SendToTelegramButton with send dialog and status polling
- Telegram admin: Bot Sends tab with delivery history table
- Shared SendHistoryRow type

README: Updated with bot docs, profiles, config vars, project structure

README.md

@@ -28,6 +28,14 @@ A self-hosted inventory management system for 3D printing filament, SLA resin, a
 - **Upload verification** — confirms files reached the destination before marking them complete
 - **Preview matching** — associates photo messages with their corresponding archive sets
 
+### Telegram Bot
+
+- **Direct delivery** — send any indexed package to a linked Telegram account with one click from the UI
+- **Account linking** — users link their Telegram account via a one-time code from Settings
+- **Package search** — search or browse indexed packages directly from conversation with the bot
+- **Subscription notifications** — subscribe to keyword patterns and get notified when matching packages arrive
+- **Automatic forwarding** — the bot copies files from the destination channel, no manual download needed
+
 ## Tech Stack
 
 - **Framework**: Next.js 16 (App Router)
@@ -38,6 +46,7 @@ A self-hosted inventory management system for 3D printing filament, SLA resin, a
 - **Tables**: TanStack Table v8 with server-side pagination
 - **Validation**: Zod v4 + React Hook Form
 - **Worker**: Node.js + TDLib (via tdl)
+- **Bot**: Node.js + TDLib (bot token auth)
 - **Archive handling**: unrar, zlib
 
 ## Quick Start
@@ -110,12 +119,30 @@ Run the entire application from Docker:
 
 ```bash
 cp .env.example .env
-# Edit .env — set TELEGRAM_API_ID, TELEGRAM_API_HASH, and a secure AUTH_SECRET
+# Edit .env — set AUTH_SECRET (required)
 docker compose up -d
 ```
 
 The app will be available at [http://localhost:3000](http://localhost:3000).
 
+### Adding Telegram Services
+
+The worker and bot run as optional profiles so `docker compose up` works with just the app + database:
+
+```bash
+# App + DB + Telegram worker (needs TELEGRAM_API_ID + TELEGRAM_API_HASH in .env)
+docker compose --profile telegram up -d
+
+# App + DB + Worker + Bot (also needs BOT_TOKEN in .env)
+docker compose --profile full up -d
+
+# Or just the bot (alongside app + db)
+docker compose --profile bot up -d
+```
+
+> **Tip:** Create a bot token via [@BotFather](https://t.me/BotFather) on Telegram and set `BOT_TOKEN` in `.env`.
+> Get Telegram API credentials from [my.telegram.org/apps](https://my.telegram.org/apps).
+
 ### Seeding the Database
 
 To seed the database with sample data on first run:
@@ -157,6 +184,7 @@ docker compose build worker && docker compose up -d worker --force-recreate
 
 ```bash
 docker compose logs -f worker   # Worker logs
+docker compose logs -f bot      # Bot logs
 docker compose logs -f app      # App logs
 docker compose logs -f db       # Database logs
 ```
@@ -174,10 +202,13 @@ src/
       paints/        # Paint CRUD
       vendors/       # Vendor management
       locations/     # Location management
-      settings/      # User preferences
+      settings/      # User preferences + Telegram link
+      stls/          # STL package browser
+      telegram/      # Telegram admin (accounts, channels, bot sends)
     api/
       auth/          # NextAuth API routes
       health/        # Health check endpoint
+      telegram/bot/  # Bot send API endpoints
   components/
     layout/          # Sidebar, header, navigation
     shared/          # Reusable data table components
@@ -197,6 +228,14 @@ worker/
     util/            # Config, logger
     worker.ts        # Main processing pipeline
     index.ts         # Entry point + scheduler
+bot/
+  src/
+    commands.ts      # Bot command handlers (/search, /link, /subscribe, etc.)
+    send-listener.ts # pg_notify listener for send requests + subscriptions
+    tdlib/           # TDLib client with bot token auth
+    db/              # Database queries for links, packages, subscriptions
+    util/            # Config, logger
+    index.ts         # Entry point
 prisma/
   schema.prisma      # Database schema
   seed.ts            # Seed data
@@ -231,6 +270,16 @@ Environment variables (see `.env.example`):
 | `MULTIPART_TIMEOUT_HOURS` | Max time span for multipart set parts (0 = no limit) | `0` |
 | `LOG_LEVEL` | Worker log level (`debug`, `info`, `warn`, `error`) | `info` |
 
+### Telegram Bot
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `BOT_TOKEN` | Bot token from [@BotFather](https://t.me/BotFather) | Optional (bot disabled if unset) |
+| `TELEGRAM_API_ID` | Same API ID as worker | Required (if bot enabled) |
+| `TELEGRAM_API_HASH` | Same API hash as worker | Required (if bot enabled) |
+| `BOT_TDLIB_STATE_DIR` | TDLib state directory for bot | `/data/tdlib_bot` |
+| `LOG_LEVEL` | Bot log level | `info` |
+
 ## Health Check
 
 The application exposes a health check endpoint at `/api/health` that verifies database connectivity.