feat(02-01): bot workspace scaffold with Env contract (D-09/D-10/D-11/D-15)

- bot/ npm workspace sibling to theme/: grammy ^1.46.0, wrangler ^4.151.3, TS ^5.9.3
- src/config.ts exports Env (BOT_TOKEN, WEBHOOK_SECRET, chat_sessions KVNamespace)
- wrangler.jsonc: main src/webhook.ts + chat_sessions KV binding (id filled in plan 03)
- .gitignore ships .dev.vars/.wrangler/ in the same commit as .dev.vars.example (D-17)
- root delegate scripts bot:test/typecheck/dev/deploy/commands

bot/.dev.vars.example

@@ -0,0 +1,4 @@
+# Copy to .dev.vars and fill for local wrangler dev (D-15). NEVER commit .dev.vars.
+BOT_TOKEN=
+WEBHOOK_SECRET=
+WEBHOOK_URL=