v0.0.28: BotFather-only registration, per-instance bot toggle, docs update

Security:
- Bot registration restricted to BotFather (requires botfather_token)
- Direct POST /v1/bot/register without BotFather auth → rejected

Deploy:
- systemd service reads /home/warzone/server.env for EXTRA_ARGS
- deploy/warzone-server.env.mequ: no bots (default)
- deploy/warzone-server.env.kh3rad3ree: --enable-bots
- setup.sh copies per-hostname env file

Docs updated:
- LLM_HELP.md: BotFather flow, plaintext bot messaging, E2E option, bridge
- LLM_BOT_DEV.md: botfather_token requirement, E2E mode, bridge section
- BOT_API.md: full BotFather flow, ownership, numeric IDs, webhook delivery
- SERVER.md: --enable-bots flag, per-instance config, bot system section
- USAGE.md: bot messaging, BotFather, bridge tool

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warzone/docs/LLM_BOT_DEV.md

@@ -5,15 +5,42 @@
 Server: `http://HOST:7700`
 All bot endpoints: `/v1/bot/<TOKEN>/METHOD`
 
-Register bot:
+**Prerequisites:** The server must be started with `--enable-bots` to activate bot functionality.
+
+### BotFather Registration
+
+Bots can only be created through `@botfather`. On first server start, BotFather is auto-created and its token is printed in the server logs.
+
+To create a bot:
+1. Message `@botfather` in the chat client (or use the BotFather token from server logs for programmatic access).
+2. BotFather calls `/v1/bot/register` with your request, including a `botfather_token` field for authorization.
+
+Registration request (sent by BotFather internally):
 ```
 POST /v1/bot/register
-{"name":"MyBot","fingerprint":"any_32_hex_chars"}
-→ {"ok":true,"result":{"token":"TOKEN","alias":"@mybot_bot"}}
+{"name":"MyBot","fingerprint":"any_32_hex_chars","botfather_token":"<bf_token>"}
+→ {"ok":true,"result":{"token":"TOKEN","alias":"@mybot_bot","owner":"<creator_fp>"}}
 ```
 
 Bot names must end with Bot/bot/_bot. Token format: `<fp_prefix>:<random_hex>`.
 
+### E2E Bot Mode
+
+Bots can optionally participate in E2E encryption. Pass additional fields during registration:
+
+```json
+{
+  "name": "SecureBot",
+  "fingerprint": "...",
+  "botfather_token": "...",
+  "e2e": true,
+  "bundle": { "identity_key": "...", "signed_prekey": "...", "signature": "...", "one_time_prekeys": ["..."] },
+  "eth_address": "0x..."
+}
+```
+
+An E2E bot registers a full prekey bundle and can establish X3DH sessions with users, receiving decryptable messages instead of `raw_encrypted` blobs.
+
 ## Endpoints
 
 ### getMe
@@ -190,25 +217,41 @@ poll();
 
 | Feature | Telegram | featherChat |
 |---------|----------|------------|
-| chat_id | numeric | hex fingerprint string |
-| getUpdates timeout | up to 50s | up to 30s |
-| User messages | plaintext | E2E encrypted (text=null in v1) |
-| Bot messages | plaintext | plaintext (no E2E) |
+| chat_id | numeric | hex fingerprint string OR numeric (both accepted) |
+| getUpdates timeout | up to 50s | up to 50s |
+| User messages | plaintext | E2E encrypted (text=null unless E2E bot) |
+| Bot messages | plaintext | plaintext (no E2E) unless E2E bot mode |
 | File upload | multipart form | JSON reference (v1) |
 | Inline keyboards | full support | stored + delivered, no popup |
 | Callback queries | full popup | acknowledged, no popup |
-| Webhooks | full HTTPS | URL stored, delivery planned |
+| Webhooks | full HTTPS | URL stored, updates delivered live (POST to webhook URL) |
 | Media groups | supported | not yet |
-| parse_mode | renders HTML/MD | stored, not rendered (v1) |
+| parse_mode | renders HTML/MD | HTML rendered (<b>, <i>, <code>, <a>) |
 
 ## Key Patterns
 
 **Always use offset** — without it, the same messages are returned every poll.
 
-**chat_id is the sender's fingerprint** — use `msg.chat.id` or `msg.from.id`.
+**chat_id is the sender's fingerprint** — use `msg.chat.id` or `msg.from.id`. Note: `from.id` is now a numeric integer for TG compatibility; use `from.id_str` for the hex fingerprint.
 
 **Bot alias** — users message bots via `@mybot_bot` which resolves to the bot's fingerprint.
 
 **Error handling** — all responses have `{"ok": bool}`. Check `ok` before accessing `result`.
 
 **Rate limits** — 200 concurrent server requests, no per-bot limit (be reasonable).
+
+## Bot Bridge (`tools/bot-bridge.py`)
+
+The bot bridge provides a compatibility layer for existing Telegram bot libraries. It translates between featherChat's Bot API and standard TG libraries.
+
+**Supported libraries:**
+- **python-telegram-bot** — set `base_url` to `http://your-server:7700/v1/bot/`
+- **aiogram** — configure the bot session with the featherChat server URL
+- **Telegraf (Node.js)** — set `telegram.apiRoot` to `http://your-server:7700/v1/bot`
+
+Usage:
+```bash
+python tools/bot-bridge.py --token YOUR_BOT_TOKEN --server http://localhost:7700
+```
+
+The bridge handles differences like fingerprint-based chat_id, numeric ID translation, and webhook forwarding.