feat(04-03): the /cari command + venue card + OPEN deep link (D-01/D-02/D-10/D-11)

- cari.ts: /cari + /search twin, 128-char pre-search cap (T-04-21), honest
  no-match refusal (D-13), single sendVenue card with inline OPEN + alternates
- deep-link carrier corrected per RESEARCH Pitfall 1: web_app button URL
  carries ?dest=<plain slug id> — WebAppInfo has only a url field; no crypto
- origin from configured MINI_APP_URL only (never user input); blank origin
  omits the OPEN button instead of guessing (T-04-30)
- strings.ts: searchUsage/searchNoMatch/searchQueryTooLong/searchOpenButton/
  osmAttribution in en+ms; helpMenu gains the /cari line in both locales
- category-only logging law (D-15): four literal rejection categories, query
  never logged; success path logs nothing
- config: MINI_APP_URL in Env + wrangler vars (public, not secret) +
  .dev.vars.example + docs/CONFIGURATION.md row and sections
- bot deps gain @araharah/search (workspace link)

bot/.dev.vars.example

@@ -3,3 +3,6 @@ BOT_TOKEN=
 WEBHOOK_SECRET=
 # Full origin + path; set-webhook.mjs auto-appends /telegram/webhook if only an origin is set.
 WEBHOOK_URL=
+# Public Mini App origin (not a secret) — lives in bot/wrangler.jsonc "vars" in production.
+# The /cari venue card's OPEN button deep link is built from it: <MINI_APP_URL>/?dest=<id>.
+MINI_APP_URL=