test(tg): grammY integration smoke tests via mocked api transport

[devin-ai-integration]

Summary

Adds a focused smoke suite for the grammY framework bindings so upstream grammY bumps (and future Renovate PRs) surface breakage before it lands in prod, without requiring a real Telegram token or network calls.

Why: the existing tests/bots/telegram-flow.test.ts only checks command regexps in isolation. We had zero coverage of the grammY Bot instance itself — so a breaking 1.x → 2.x API change (request transformer signature, update routing, error boundary) would have silently passed CI until a real deploy.

What's new (tests/bots/grammy-smoke.test.ts):

• Spins up a real new Bot(...) with a preset botInfo (skips getMe) and swaps the API transport via bot.api.config.use(...) to record every outbound call without hitting Telegram.
• Asserts that:
  1. a /start text update is routed to its bot.hears(...) handler and the reply lands as a sendMessage call with the right chat id + text
  2. a non-matching text update triggers zero outbound calls
  3. a middleware that throws surfaces as a grammY BotError with the original error attached on .error — catches the contract we rely on for tg_update_handler_error logging in src/services/bots/tg/index.ts
  4. bot.command('ics', ...) with a realistic entities: [{ type: 'bot_command', ... }] payload fires the handler and sends the reply

No prod code change.

Checks:

• pnpm run test:all — 33 files / 214 tests pass
• pnpm run ts-check / pnpm run lint / pnpm run format:check — clean
• pnpm audit --audit-level=low — no known vulnerabilities

Run the new tests with: pnpm exec vitest run tests/bots/grammy-smoke.test.ts

Stacked on PR #20.

Review & Testing Checklist for Human

• Bump grammY locally one major (e.g. pnpm add grammy@2) and run pnpm exec vitest run tests/bots/grammy-smoke.test.ts — the suite should break loudly if the transport or error-boundary contracts change.
• Run pnpm run test:all from a fresh checkout to confirm nothing flaky.

Notes

• Deeper integration coverage (spinning up the full BotService → Chat DB round-trip → keyboard rendering) isn't in scope here — it would require an in-memory Sequelize fixture and the whole service dependency graph bootstrapped per test. Can be added as a follow-up if the smoke layer starts missing regressions.
• This closes out the A–M plan. Stack merge order: feat(app): service dependency graph with fail-fast and topological startup #17 → feat(http): unauthenticated /api/health and /api/metrics on http service #18 → feat(api): IP/key rate limit on /api routes with configurable thresholds #19 → feat(app): graceful shutdown on SIGTERM/SIGINT via App.stop #20 → this one.

Link to Devin session: https://app.devin.ai/sessions/7732f5fd16e9448295cbabeb8b5f471a
Requested by: @BlindMaster24

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.