feat: bot alias reservation + BOT_API.md documentation

- Aliases ending with Bot/bot/_bot reserved for registered bots only
- Non-bot users get clear error directing to /v1/bot/register
- Bot registration auto-creates alias (@name_bot suffix)
- BOT_API.md: full developer guide with endpoints, examples, echo bot
- LLM_HELP.md: expanded bot section with update types + Python example

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warzone/docs/LLM_HELP.md

@@ -45,6 +45,8 @@ ETH address | 0x742d35Cc... | derived from same seed, checksum format
 
 All 3 formats work in /peer. Aliases resolve to fp via server. One alias per user. Register with /alias, recover with recovery key.
 
+Bot alias reservation: names ending in Bot, bot, or _bot are reserved for the Bot API. Non-bot users cannot register these aliases.
+
 ## Quick Start
 
 1. `warzone init` -- generates seed, saves identity.seed, prints 24-word mnemonic. WRITE IT DOWN.
@@ -127,23 +129,44 @@ Problem | Cause | Fix
 "file too large" | over 10MB | split file manually
 no prekeys available | recipient's one-time prekeys exhausted | they need to re-register or come online
 
-## Bot API
+## Bot API (Telegram-compatible)
 
-Telegram-compatible REST API. Base: /v1/
+Register: POST /v1/bot/register {"name":"MyBot","fingerprint":"<fp>"}
+→ returns token + auto-creates @mybot_bot alias
 
-Endpoint | Method | Body | Returns
---- | --- | --- | ---
-/bot/register | POST | {"name":"mybot","fingerprint":"abc..."} | {"token":"...","name":"..."}
-/bot/:token/getMe | GET | -- | bot info
-/bot/:token/getUpdates | POST | {"timeout":5} | array of Update objects
-/bot/:token/sendMessage | POST | {"chat_id":"<fp>","text":"hello"} | msg confirmation
+Bot aliases must end with Bot, bot, or _bot. Non-bots cannot use these.
+
+|Endpoint|Method|Body|
+|---|---|---|
+|/bot/:token/getMe|GET|—|
+|/bot/:token/getUpdates|POST|{"timeout":5}|
+|/bot/:token/sendMessage|POST|{"chat_id":"<fp>","text":"Hello"}|
 
 - Token format: fp_prefix:random_hex
 - getUpdates: long-poll (max 5s), returns then deletes queued msgs
 - sendMessage: plaintext JSON, NOT E2E encrypted
-- Updates include: messages, key exchanges, call signals, file headers
 - Bot msgs delivered via same routing (WS push or DB queue)
 
+Update types in getUpdates:
+- Encrypted msg: text=null, raw_encrypted=base64
+- Bot msg (plaintext): text="actual text", from.is_bot=true
+- Call signal: text="/call_Offer", call_signal={type,payload}
+- File: document={file_name,file_size}
+
+v1 limits: sendMessage is plaintext (no E2E), timeout max 5s, no webhooks yet.
+
+Echo bot (Python):
+```python
+import requests, time
+TOKEN = "your_token"
+API = f"http://srv:7700/v1/bot/{TOKEN}"
+while True:
+    for u in requests.post(f"{API}/getUpdates",json={"timeout":5}).json().get("result",[]):
+        m = u["message"]
+        if m.get("text"): requests.post(f"{API}/sendMessage",json={"chat_id":m["chat"]["id"],"text":"Echo: "+m["text"]})
+    time.sleep(1)
+```
+
 ## Server API (other endpoints)
 
 - POST /v1/register -- upload prekey bundle