Telegram Webhook

Receive Telegram Bot API updates (callback queries from inline button taps).

Security: Telegram sends X-Telegram-Bot-Api-Secret-Token header on every update. We verify it matches TELEGRAM_WEBHOOK_SECRET (set via setWebhook secret_token param). Returns 403 on mismatch to reject spoofed requests.

Handles:

• callback_query: inline button taps (Approve / Edit / Skip)
• message: text replies (edit direction from Edu)

Always returns {"ok": true} on success — Telegram retries on non-200.