fix(02-03): set-webhook auto-appends /telegram/webhook to a pathless URL

- Deploy walkthrough revealed a bare workers.dev origin setWebhook answers ok but drops updates at / (404)
- Normalize WEBHOOK_URL: no path -> append /telegram/webhook; invalid URL -> fail fast, never echo values (T-02-04)
- .dev.vars.example documents the path expectation

bot/scripts/set-webhook.mjs

@@ -11,6 +11,10 @@
  * Inputs come from bot/.dev.vars (gitignored, D-15): BOT_TOKEN,
  * WEBHOOK_URL, WEBHOOK_SECRET. The bot token is never echoed — on failure
  * only the API's error_code/description are printed (T-02-04).
+ * WEBHOOK_URL is normalized: if the configured origin points at the
+ * workers.dev root (no path), /telegram/webhook is appended automatically —
+ * a bare origin passed the 2026-10-22 deploy walkthrough caused Telegram to
+ * answer ok but deliver nothing (updates routed to "/" → 404).
  * Exit 0 only when Telegram answers ok:true.
  */
 import { readFileSync } from "node:fs";
@@ -49,8 +53,27 @@ if (missing.length > 0) {
   process.exit(1);
 }
 
+// Auto-append the route path when the URL has none — prevents the recurring
+// misconfiguration where a bare workers.dev origin is registered and the
+// Worker answers ok:true but Telegram updates land on "/" (404, silent drop).
+const WEBHOOK_ROUTE = "/telegram/webhook";
+let normalizedUrl;
+try {
+  const parsed = new URL(webhookUrl);
+  if (parsed.pathname === "/" || parsed.pathname === "") {
+    parsed.pathname = WEBHOOK_ROUTE;
+    normalizedUrl = parsed.toString();
+    console.log(`WEBHOOK_URL had no path — normalized to ...${WEBHOOK_ROUTE}`);
+  } else {
+    normalizedUrl = webhookUrl;
+  }
+} catch {
+  console.error(`WEBHOOK_URL is not a valid URL — check bot/.dev.vars (value never echoed).`);
+  process.exit(1);
+}
+
 const payload = {
-  url: webhookUrl,
+  url: normalizedUrl,
   secret_token: secret,
   allowed_updates: ["message"],
 };