feat: add NFT usernames and bot verification (#22)

Implements collectible usernames, official verification workflows, and third-party bot verification after maintainer protocol and migration review.

The composite activity/moderation rating remains an admin-only read model; Telegram Stars Rating wire fields stay unset pending a dedicated official-semantics implementation.

Reviewed-Head: 2796345775ea0f908fb7734601e5e1dee4b653b9
Original-Head: fa082b892fd5180c9c9bc53c81c21cf5d250a75b

Co-authored-by: Egor Egorov <business.egor.sg@gmail.com>

cmd/telesrv-admin/main.go

@@ -71,6 +71,11 @@ type uiConfig struct {
 	Password      string
 	Token         string
 	SessionKey    []byte
+	// Permissions is the right set a panel session is issued with, from
+	// TELESRV_ADMIN_UI_PERMISSIONS. The shipped default is the single wildcard
+	// entry, so introducing the permission model never locks an operator out of a
+	// panel that worked before.
+	Permissions []string
 }
 
 // loadConfig 通过 internal/config.Load() 加载 .env 配置文件与环境变量，
@@ -105,6 +110,7 @@ func loadConfig() (uiConfig, error) {
 		Password:      appCfg.AdminUIPassword,
 		Token:         appCfg.AdminUIToken,
 		SessionKey:    sum[:],
+		Permissions:   appCfg.AdminUIPermissions,
 	}, nil
 }