feat: Docker audit + Telegram bot service + send UI

Docker:
- Harden docker-compose.yml: parameterized DB creds, required AUTH_SECRET,
  health checks, resource limits, network isolation, removed exposed DB port
- Add profiles (telegram/bot/full) so base 'docker compose up' needs only AUTH_SECRET
- Fix docker-entrypoint.sh: AUTH_SECRET startup guard
- Fix Dockerfile: copy prisma.config.ts + dotenv into production image
- Update .env.example with all new variables
- Update .dockerignore

Telegram Bot Service (bot/):
- TDLib-based bot using bot token auth (not HTTP Bot API)
- Commands: /search, /latest, /package, /link, /unlink, /subscribe, /unsubscribe
- pg_notify listener for send requests (bot_send) and new packages (new_package)
- Subscription-based notifications when matching packages arrive
- Dockerfile with multi-stage build (bookworm-slim for glibc/TDLib)

API & Database:
- Prisma: TelegramLink, BotSendRequest, BotSubscription models + migration
- POST /api/telegram/bot/send - queue package delivery to linked TG account
- GET /api/telegram/bot/send/[id] - poll send request status
- Server actions: generateTelegramLinkCode, unlinkTelegram, getBotSendHistory
- Worker: emit pg_notify('new_package') after creating packages

Frontend:
- Settings: TelegramLinkCard for account linking via one-time code
- STL table + drawer: SendToTelegramButton with send dialog and status polling
- Telegram admin: Bot Sends tab with delivery history table
- Shared SendHistoryRow type

README: Updated with bot docs, profiles, config vars, project structure

prisma/migrations/20260303200000_add_telegram_bot/migration.sql

@@ -0,0 +1,67 @@
+-- CreateEnum
+CREATE TYPE "BotSendStatus" AS ENUM ('PENDING', 'SENDING', 'SENT', 'FAILED');
+
+-- CreateTable
+CREATE TABLE "telegram_links" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "telegramUserId" BIGINT NOT NULL,
+    "telegramName" VARCHAR(128),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "telegram_links_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "bot_send_requests" (
+    "id" TEXT NOT NULL,
+    "packageId" TEXT NOT NULL,
+    "telegramLinkId" TEXT NOT NULL,
+    "requestedByUserId" TEXT NOT NULL,
+    "status" "BotSendStatus" NOT NULL DEFAULT 'PENDING',
+    "error" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "completedAt" TIMESTAMP(3),
+
+    CONSTRAINT "bot_send_requests_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "bot_subscriptions" (
+    "id" TEXT NOT NULL,
+    "telegramUserId" BIGINT NOT NULL,
+    "pattern" VARCHAR(256) NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "bot_subscriptions_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "telegram_links_userId_key" ON "telegram_links"("userId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "telegram_links_telegramUserId_key" ON "telegram_links"("telegramUserId");
+
+-- CreateIndex
+CREATE INDEX "bot_send_requests_status_idx" ON "bot_send_requests"("status");
+
+-- CreateIndex
+CREATE INDEX "bot_send_requests_telegramLinkId_idx" ON "bot_send_requests"("telegramLinkId");
+
+-- CreateIndex
+CREATE INDEX "bot_send_requests_createdAt_idx" ON "bot_send_requests"("createdAt");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "bot_subscriptions_telegramUserId_pattern_key" ON "bot_subscriptions"("telegramUserId", "pattern");
+
+-- CreateIndex
+CREATE INDEX "bot_subscriptions_telegramUserId_idx" ON "bot_subscriptions"("telegramUserId");
+
+-- AddForeignKey
+ALTER TABLE "telegram_links" ADD CONSTRAINT "telegram_links_userId_fkey" FOREIGN KEY ("userId") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "bot_send_requests" ADD CONSTRAINT "bot_send_requests_packageId_fkey" FOREIGN KEY ("packageId") REFERENCES "packages"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "bot_send_requests" ADD CONSTRAINT "bot_send_requests_telegramLinkId_fkey" FOREIGN KEY ("telegramLinkId") REFERENCES "telegram_links"("id") ON DELETE CASCADE ON UPDATE CASCADE;

prisma/schema.prisma

@@ -4,6 +4,7 @@ generator client {
 
 datasource db {
   provider = "postgresql"
+  url      = env("DATABASE_URL")
 }
 
 // ───────────────────────────────────────
@@ -34,9 +35,10 @@ model User {
   supplies  Supply[]
   vendors   Vendor[]
   locations Location[]
-  usageLogs UsageLog[]
-  tags      Tag[]
-  settings  UserSettings?
+  usageLogs    UsageLog[]
+  tags         Tag[]
+  settings     UserSettings?
+  telegramLink TelegramLink?
 }
 
 model Account {
@@ -469,6 +471,7 @@ model Package {
   files          PackageFile[]
   ingestionRun   IngestionRun?   @relation(fields: [ingestionRunId], references: [id])
   ingestionRunId String?
+  sendRequests   BotSendRequest[]
 
   @@index([sourceChannelId])
   @@index([destChannelId])
@@ -566,3 +569,61 @@ model ChannelFetchRequest {
   @@index([accountId, status])
   @@map("channel_fetch_requests")
 }
+
+// ───────────────────────────────────────
+// Telegram Bot models
+// ───────────────────────────────────────
+
+enum BotSendStatus {
+  PENDING
+  SENDING
+  SENT
+  FAILED
+}
+
+/// Links a NextAuth user to a Telegram user ID.
+/// Created when a user sends /link <code> to the bot.
+model TelegramLink {
+  id             String   @id @default(cuid())
+  userId         String   @unique
+  telegramUserId BigInt   @unique
+  telegramName   String?  @db.VarChar(128)
+  createdAt      DateTime @default(now())
+
+  user         User             @relation(fields: [userId], references: [id], onDelete: Cascade)
+  sendRequests BotSendRequest[]
+
+  @@map("telegram_links")
+}
+
+/// A queued request to send a package to a Telegram user via the bot.
+model BotSendRequest {
+  id               String        @id @default(cuid())
+  packageId        String
+  telegramLinkId   String
+  requestedByUserId String
+  status           BotSendStatus @default(PENDING)
+  error            String?
+  createdAt        DateTime      @default(now())
+  completedAt      DateTime?
+
+  package       Package       @relation(fields: [packageId], references: [id])
+  telegramLink  TelegramLink  @relation(fields: [telegramLinkId], references: [id], onDelete: Cascade)
+
+  @@index([status])
+  @@index([telegramLinkId])
+  @@index([createdAt])
+  @@map("bot_send_requests")
+}
+
+/// Subscriptions for new-package notifications via the bot.
+model BotSubscription {
+  id             String   @id @default(cuid())
+  telegramUserId BigInt
+  pattern        String   @db.VarChar(256)
+  createdAt      DateTime @default(now())
+
+  @@unique([telegramUserId, pattern])
+  @@index([telegramUserId])
+  @@map("bot_subscriptions")
+}