feat(04-03): the /cari command + venue card + OPEN deep link (D-01/D-02/D-10/D-11)

- cari.ts: /cari + /search twin, 128-char pre-search cap (T-04-21), honest
  no-match refusal (D-13), single sendVenue card with inline OPEN + alternates
- deep-link carrier corrected per RESEARCH Pitfall 1: web_app button URL
  carries ?dest=<plain slug id> — WebAppInfo has only a url field; no crypto
- origin from configured MINI_APP_URL only (never user input); blank origin
  omits the OPEN button instead of guessing (T-04-30)
- strings.ts: searchUsage/searchNoMatch/searchQueryTooLong/searchOpenButton/
  osmAttribution in en+ms; helpMenu gains the /cari line in both locales
- category-only logging law (D-15): four literal rejection categories, query
  never logged; success path logs nothing
- config: MINI_APP_URL in Env + wrangler vars (public, not secret) +
  .dev.vars.example + docs/CONFIGURATION.md row and sections
- bot deps gain @araharah/search (workspace link)

bot/src/i18n/strings.ts

@@ -35,6 +35,20 @@ export interface BotStrings {
   /** GEO-02: confirmation after the user's shared pin has been recorded
    *  in the TTL-only location-pin KV (GEO-03). */
   pinReceived: string;
+  /** SRCH-03/D-01: the empty-query usage line for /cari. */
+  searchUsage: string;
+  /** D-13: the honest out-of-area refusal — names the v1 area, promises
+   *  no pin. Never echoes the query text (D-15). */
+  searchNoMatch: string;
+  /** V5: the over-cap refusal for an over-long /cari argument. */
+  searchQueryTooLong: string;
+  /** D-10: the OPEN label on the venue card's web_app button — a product
+   *  affordance, identical in both locales by design. */
+  searchOpenButton: string;
+  /** The OSM data attribution for search-driven surfaces — identical in
+   *  both locales (legal attribution, not prose; same string as
+   *  web/src/i18n/strings.ts). */
+  osmAttribution: string;
 }
 
 export type Locale = "en" | "ms";
@@ -48,10 +62,15 @@ export const strings: Record<Locale, BotStrings> = {
     privacyNotStored:
       "What araharah never keeps: your location, your routes, your trip history, any profile about you.",
     helpMenu:
-      "Commands:\n/help — How araharah works and what it keeps\n/privacy — What araharah stores and never stores",
+      "Commands:\n/help — How araharah works and what it keeps\n/privacy — What araharah stores and never stores\n/cari — Search for a destination in the KL metro",
     awaitingPin: "Send me a pin in this chat and I'll use it as your starting point.",
     shareLocationButton: "Share my location",
     pinReceived: "Got it — your starting point is set.",
+    searchUsage: "/cari <place> — search for a destination in the KL metro.",
+    searchNoMatch: "Not in the v1 KL area. araharah only knows Kuala Lumpur and the Klang Valley for now.",
+    searchQueryTooLong: "That query is too long. Send just the place name.",
+    searchOpenButton: "OPEN IN ARAHARAH",
+    osmAttribution: "© OpenStreetMap contributors",
   },
   ms: {
     startIntro:
@@ -61,10 +80,15 @@ export const strings: Record<Locale, BotStrings> = {
     privacyNotStored:
       "Yang araharah tidak pernah simpan: lokasi anda, laluan anda, sejarah perjalanan anda, apa-apa profil tentang anda.",
     helpMenu:
-      "Arahan:\n/help — Cara araharah berfungsi dan apa yang ia simpan\n/privacy — Apa yang araharah simpan dan tidak pernah simpan",
+      "Arahan:\n/help — Cara araharah berfungsi dan apa yang ia simpan\n/privacy — Apa yang araharah simpan dan tidak pernah simpan\n/cari — Cari destinasi di kawasan KL",
     awaitingPin: "Hantar saya pin dalam chat ini dan saya akan gunakannya sebagai titik mula anda.",
     shareLocationButton: "Kongsi lokasi saya",
     pinReceived: "Baik — titik mula anda sudah ditetapkan.",
+    searchUsage: "/cari <tempat> — cari destinasi dalam kawasan KL.",
+    searchNoMatch: "Bukan dalam kawasan KL v1. araharah hanya tahu Kuala Lumpur dan Lembah Klang buat masa ini.",
+    searchQueryTooLong: "Pertanyaan itu terlalu panjang. Hantar nama tempat sahaja.",
+    searchOpenButton: "OPEN IN ARAHARAH",
+    osmAttribution: "© OpenStreetMap contributors",
   },
 };