Bot commands are undiscoverable without already knowing them

[rvalitov]

Type: enhancement
Area: Telegram bot
Addressed by: PR 1 of 4 (feat(telegram): register the bot command menu with setMyCommands)

Summary

The bot implements 27 commands, but nothing advertises them. Tapping the /
menu button in a Telegram chat shows an empty list, because the bot never
calls setMyCommands.

The only in-band pointer is /mp_help — which a user has to already know exists.

Impact

• Public self-service is effectively unusable. The entire point of the public
  tier (/start, /my_status <label>, /redeem) is that an end user can check
  their own quota and expiry without an admin walking them through it. In
  practice they cannot discover the commands, so every new user becomes an admin
  support request.
• Admins under-use the control plane. Commands like /mp_digest,
  /mp_fleet and /mp_traffic are not discoverable from the UI at all.
• Role-scoped commands are indistinguishable from ones the user cannot run, so a
  reseller has no way to see what they are actually permitted to do.

Reproduction

1. Configure the bot with mtproxymax telegram setup.
2. Open the chat with the bot on any Telegram client.
3. Tap the / menu button.

Expected: a list of the commands you are allowed to run.
Actual: an empty list.

Proposal

Register per-scope command lists with setMyCommands:

• A default scope for everyone, containing the public self-service commands.
• A chat scope per admin, containing the admin control plane.
• A chat scope for superadmins, additionally containing /mp_remove,
  /mp_restart, /mp_update and /mp_lockdown.

Scopes should mirror the gates the dispatcher already applies, so the menu never
advertises something a role cannot run. On role revocation the chat's custom
scope should be deleted, so a demoted admin stops seeing the admin plane.

The list should be re-synced on bot service start, on role grant/revoke, at the
end of setup, and on demand via a CLI subcommand.

Acceptance criteria

• Tapping / shows the public commands for an unauthenticated user.
• An admin sees the admin control plane.
• A superadmin additionally sees the four privileged commands.
• A reseller sees only what it may actually run.
• Revoking an admin removes the admin commands from their menu.
• A Telegram outage during sync does not abort setup or stall the poll loop.
• The bot token never appears in the process list.