fix(admin): close PR review blockers

Keep bot credentials out of durable command results, fail bot deletion closed when session revocation fails, reject invalid scam/fake states at every write boundary, and make direct collectible grants a single replayable PostgreSQL aggregate.

Also lock admin gift sender/message limits and add regression coverage for rollback, replay, moderation constraints, and credential redaction.

internal/app/bots/service_test.go

@@ -181,6 +181,7 @@ type countingBotStore struct {
 	*memory.BotStore
 	getBotCalls  int
 	getBotsCalls int
+	deleteCalls  int
 }
 
 func (s *countingBotStore) reset() {
@@ -198,6 +199,11 @@ func (s *countingBotStore) GetBots(ctx context.Context, botUserIDs []int64) (map
 	return s.BotStore.GetBots(ctx, botUserIDs)
 }
 
+func (s *countingBotStore) DeleteBotAccount(_ context.Context, botUserID int64) (domain.User, error) {
+	s.deleteCalls++
+	return domain.User{ID: botUserID, Bot: true, Deleted: true}, nil
+}
+
 func TestBotFatherCancelAndUnknown(t *testing.T) {
 	svc, users, _, messages := newTestService(t)
 	owner := newOwner(t, users, "+1001")