feat(04-03): the /cari command + venue card + OPEN deep link (D-01/D-02/D-10/D-11)

- cari.ts: /cari + /search twin, 128-char pre-search cap (T-04-21), honest
  no-match refusal (D-13), single sendVenue card with inline OPEN + alternates
- deep-link carrier corrected per RESEARCH Pitfall 1: web_app button URL
  carries ?dest=<plain slug id> — WebAppInfo has only a url field; no crypto
- origin from configured MINI_APP_URL only (never user input); blank origin
  omits the OPEN button instead of guessing (T-04-30)
- strings.ts: searchUsage/searchNoMatch/searchQueryTooLong/searchOpenButton/
  osmAttribution in en+ms; helpMenu gains the /cari line in both locales
- category-only logging law (D-15): four literal rejection categories, query
  never logged; success path logs nothing
- config: MINI_APP_URL in Env + wrangler vars (public, not secret) +
  .dev.vars.example + docs/CONFIGURATION.md row and sections
- bot deps gain @araharah/search (workspace link)

bot/wrangler.jsonc

@@ -15,5 +15,10 @@
     "not_found_handling": "none"
   },
   "run_worker_first": ["/api/*", "/telegram/*"],
+  // Public vars (NOT secrets): the deployed Mini App ORIGIN used to build
+  // the /cari venue card's OPEN deep link (<MINI_APP_URL>/?dest=<id>).
+  // It must equal the Mini App URL registered in @BotFather (Bot API 10.2
+  // enforces the origin). Never derived from user input.
+  "vars": { "MINI_APP_URL": "https://araharah-bot.araharah-bot.workers.dev" },
   "kv_namespaces": [{ "binding": "chat_sessions", "id": "59f58a54bc44483e89872b20a005a5eb" }]
 }