Add full system audit reports and Telegram Mini App debug handoff

- Three-stream audit (security / logic / performance) with 35+ findings
  derived from actual source code, each with file:line and remediation
- Audit Index cross-references criticals across streams into prioritized
  fix tiers: immediately / before soft launch / before public launch
- Telegram Mini App debug handoff documenting what was implemented and
  all remaining work items with exact file lists and test commands
- Updated architecture, data model, auth API, and registration flow docs
  to reflect Telegram auth, TON wallet, and email verification additions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

01 - Architecture/Backend Architecture.md

@@ -37,10 +37,17 @@ backend/src/
 │   ├── file/                   # Multer uploads, MIME validation
 │   ├── marketplace/            # PurchaseRequest, SellerOffer, Template, Shop
 │   ├── notification/           # Templates, delivery, mark-as-read
-│   ├── payment/                # Payment orchestration + shkeeper/ subdir
+│   ├── payment/                # Payment orchestration + provider adapters + ledger
+│   │   ├── adapters/           # Provider-neutral adapter interface + registry
+│   │   ├── ledger/             # Internal funds ledger (available / held / releasable)
+│   │   ├── reconciliation/     # Webhook + status reconciliation per provider
+│   │   ├── migration/          # Legacy data backfill utilities
+│   │   ├── observability/      # Logging and incident controls
+│   │   ├── requestNetwork/     # Request Network pay-in, routes, webhook signature
 │   │   └── shkeeper/           # SHKeeper API, webhook, payout
 │   ├── points/                 # Loyalty points, levels, redemption
 │   ├── redis/                  # Redis client, cache helpers
+│   ├── telegram/               # Bot webhook, Mini App session, identity linking, notifications
 │   ├── user/                   # Profile, preferences, addresses
 │   ├── admin/                  # Admin-only operations
 │   └── email/                  # Nodemailer transport + templates
@@ -98,8 +105,8 @@ The bootstrap is intentionally linear and easy to audit. Execution order:
 | 10 | `notFound` | tail | Returns 404 envelope for unmatched routes. |
 | 11 | `errorHandler` | tail | Catches thrown errors, formats response. |
 
-> [!warning]
-> Rate-limit middleware is **disabled by default for personal use** (see `app.ts:227` cited in the architecture review). Enable before any real public traffic — `express-rate-limit` is already a dependency.
+> [!note]
+> Rate-limit middleware is **active** as of 2026-05-24: auth 10 req/15 min, payment 30/15 min, AI 20/15 min, global 100/15 min. Request Network and Telegram webhooks are exempt from the global limiter. Counters are in-memory — a Redis adapter is planned for distributed deployments.
 
 ---
 
@@ -121,7 +128,8 @@ The full route table mounted by `app.ts`:
 | `/api/payment/decentralized` | `services/payment/decentralizedPaymentRoutes.ts` | mixed | Web3 save, verify, receiver |
 | `/api/payment/shkeeper` | `services/payment/shkeeper/shkeeperRoutes.ts` | mixed | Intents, webhook, release, refund, config |
 | `/api/payment/shkeeper/payout` | `services/payment/shkeeper/shkeeperPayoutRoutes.ts` | JWT (seller/admin) | Withdraw to wallet |
-| `/api/payment/request-network` | `services/payment/requestNetwork/requestNetworkRoutes.ts` | HMAC | Request Network webhooks |
+| `/api/payment/request-network` | `services/payment/requestNetwork/requestNetworkRoutes.ts` | HMAC sig | Request Network pay-in creation, Secure Payment Page, webhooks |
+| `/api/telegram` | `services/telegram/telegramRoutes.ts` | mixed (some JWT, webhook uses secret-token) | Mini App verify/session, identity link/unlink, bot webhook |
 | `/api/chat` | `services/chat/chatRoutes.ts` | JWT | Conversations, messages |
 | `/api/notification` | `services/notification/notificationRoutes.ts` + `notificationControllerRouter` | JWT | List, mark read |
 | `/api/dispute` | `services/dispute/disputeRoutes.ts` | JWT | **Not implemented** — planned |
@@ -175,15 +183,19 @@ flowchart TB
     file[file]
     email[email]
     socket[socket]
+    telegram[telegram]
 
     auth --> user
     auth --> notify
+    auth --> telegram
     market --> notify
     market --> chat
     market --> file
     pay --> market
     pay --> notify
     pay --> socket
+    telegram --> notify
+    telegram --> auth
     dispute -.-> market
     dispute -.-> chat
     dispute -.-> notify