feat: add NFT usernames and bot verification (#22)

Implements collectible usernames, official verification workflows, and third-party bot verification after maintainer protocol and migration review.

The composite activity/moderation rating remains an admin-only read model; Telegram Stars Rating wire fields stay unset pending a dedicated official-semantics implementation.

Reviewed-Head: 2796345775ea0f908fb7734601e5e1dee4b653b9
Original-Head: fa082b892fd5180c9c9bc53c81c21cf5d250a75b

Co-authored-by: Egor Egorov <business.egor.sg@gmail.com>

.env.example

@@ -125,6 +125,21 @@ TELESRV_ADMIN_API_ADDR=
 # Admin UI 监听地址，默认值通常无需修改；RTMP ingest 保留 2400。
 TELESRV_ADMIN_UI_ADDR=127.0.0.1:2600
 
+# Permissions granted to an Admin UI session that logged in with
+# TELESRV_ADMIN_UI_PASSWORD / _TOKEN. Comma-separated; "*" means every
+# permission and is the default, so enabling RBAC never locks an operator out of
+# a panel that worked before. Names are letters/digits/._:- and may end in
+# "namespace.*" to grant a whole namespace.
+TELESRV_ADMIN_UI_PERMISSIONS=*
+
+# Additional Admin API bearer tokens with a bounded permission set each, so an
+# integration gets exactly the rights it needs instead of the unrestricted
+# TELESRV_ADMIN_API_TOKEN. Format: "name:token:perm1,perm2" entries separated by
+# ';'. A token may not contain ':' or whitespace, names and tokens must be
+# unique, and reusing TELESRV_ADMIN_API_TOKEN here is refused; any malformed
+# entry fails startup rather than silently granting or dropping rights.
+TELESRV_ADMIN_SCOPED_TOKENS=
+
 TELESRV_POSTGRES_DSN=postgres://telesrv:telesrv@127.0.0.1:5432/telesrv?sslmode=disable
 TELESRV_REDIS_ADDR=127.0.0.1:6399
 TELESRV_REDIS_PASSWORD=
@@ -167,6 +182,90 @@ TELESRV_STARGIFT_TRANSFER_DELAY=0s
 TELESRV_STARGIFT_RESELL_DELAY=0s
 TELESRV_STARGIFT_CRAFT_DELAY=0s
 TELESRV_STARGIFT_CRAFT_CHANCE_PERMILLE=250
+
+# Local admin-only composite account rating. It is not projected into Telegram's
+# userFull.stars_rating fields. Disabling it refuses local rating writes.
+TELESRV_RATING_ENABLED=true
+# A local rating increase is parked for this long before it becomes the visible
+# admin level; a decrease always applies immediately. 0 applies every change at once.
+TELESRV_RATING_PENDING_DELAY=24h
+# Background recompute worker: the rating derives from signals owned by other
+# subsystems, so freshness is a worker property rather than a write-path one.
+TELESRV_RATING_RECOMPUTE_INTERVAL=15m
+TELESRV_RATING_RECOMPUTE_BATCH=500
+TELESRV_RATING_STALE_AFTER=6h
+# Integer composite weights; the defaults below are exactly the shipped domain
+# formula. Penalties are magnitudes that the formula subtracts, so every value is
+# non-negative and a negative one fails startup.
+TELESRV_RATING_WEIGHT_STARS_RECEIVED_PERMILLE=1000
+TELESRV_RATING_WEIGHT_STARS_SPENT_PERMILLE=250
+TELESRV_RATING_WEIGHT_MESSAGE_SENT=1
+TELESRV_RATING_WEIGHT_ACCOUNT_AGE_DAY=2
+TELESRV_RATING_WEIGHT_GIFT_RECEIVED=25
+TELESRV_RATING_WEIGHT_MODERATION_CASE=150
+TELESRV_RATING_WEIGHT_SCAM_PENALTY=5000
+TELESRV_RATING_WEIGHT_FAKE_PENALTY=5000
+# Upper bound of the activity component so activity alone cannot outweigh Stars
+# and moderation; 0 leaves it uncapped.
+TELESRV_RATING_ACTIVITY_CAP=5000
+
+# Landing URL recorded on a minted collectible (NFT) username when the mint
+# command carries no explicit URL. Empty derives
+# <TELESRV_PUBLIC_BASE_URL>/nft/username/<username>. A template may carry the
+# {username} placeholder; without it the name is appended as the last path
+# segment. No external marketplace is contacted.
+TELESRV_COLLECTIBLE_USERNAME_URL_TEMPLATE=
+
+# Official platform verification: applications filed through the built-in
+# @verifybot and decided in the admin panel. An approval flips the platform
+# verified flag on the target peer and nothing else; it is not the third-party
+# bot verification icon. Disabling refuses every verification use case, while
+# peers already carrying the badge keep it.
+TELESRV_VERIFICATION_ENABLED=true
+# Plain user accounts as verification subjects. Off by default: the official
+# process verifies a public presence (bot, public channel, public supergroup).
+TELESRV_VERIFICATION_ALLOW_USER_TARGETS=false
+# How long an applicant must wait before filing the same target again after a
+# rejection, measured from the decision so a slow review never shortens it.
+# 0 disables the cooldown; must be 0..8760h.
+TELESRV_VERIFICATION_REJECT_COOLDOWN=720h
+# Applications one applicant may create per window. Either value 0 disables the
+# budget; a positive limit requires a positive window.
+TELESRV_VERIFICATION_APPLY_RATE_LIMIT=3
+TELESRV_VERIFICATION_APPLY_RATE_WINDOW=24h
+# @verifybot dialog rate per applicant, independent of how many applications are
+# actually created. Either value 0 disables it.
+TELESRV_VERIFICATION_BOT_RATE_LIMIT=30
+TELESRV_VERIFICATION_BOT_RATE_WINDOW=1m
+# Applicant notification worker. A decision commits with its outbox row, never
+# with a message send, so delivery is a separate retrying cycle over durable
+# rows. Interval must be positive; batch must be 1..500.
+TELESRV_VERIFICATION_NOTIFY_INTERVAL=15s
+TELESRV_VERIFICATION_NOTIFY_BATCH=50
+# Applications one applicant may keep open at once; 0 disables the cap, maximum
+# is 50.
+TELESRV_VERIFICATION_MAX_ACTIVE_PER_USER=3
+
+# Third-party bot verification (core.telegram.org/api/bots/verification): a
+# verifier bot marks peers with its OWN icon and description, which clients render
+# before the name. This is NOT the platform checkmark above: the operator grants
+# verifier status to a bot, and the two mechanisms never read each other's state.
+# Disabling refuses every third-party mutation (grants, revocations, applications,
+# icon catalogue edits) while the marks already granted keep rendering -- blanking
+# one verifier's badges is what its per-verifier kill switch is for.
+TELESRV_BOT_VERIFICATION_ENABLED=true
+# Peers one verifier bot may mark. Verifier status is granted per deployment rather
+# than earned per peer, so an unbounded verifier would be an unbounded badge
+# printer. 0 disables the service bound and leaves only the storage bound, which is
+# also the maximum accepted here (10000).
+TELESRV_BOT_VERIFICATION_MAX_PER_VERIFIER=10000
+# Verification applications one applicant may file per window, across all verifier
+# bots. Either value 0 disables the budget; a positive limit requires a positive
+# window. Looser than the official budget on purpose: a deployment can run several
+# verifier companies, and filing with a second one is not a retry of the first.
+TELESRV_BOT_VERIFICATION_REQUEST_RATE_LIMIT=5
+TELESRV_BOT_VERIFICATION_REQUEST_RATE_WINDOW=24h
+
 TELESRV_BLOB_DIR=data/blobs
 TELESRV_STICKER_SEED_DIR=data/sticker-seed
 # Optional Premium feature-preview media export. Missing directory keeps the