Initial commit — federated self-custodial Spark/Lightning tip bot

- grammY bot: /start, /unlock, /tip, /contact, /claim, /settings, /wallet
- AES-256-GCM mnemonic encryption with scrypt key derivation
- In-memory unlock sessions with background sweep
- Atomic claim handling (TOCTOU-safe)
- PIN rate limiting (5 attempts → 15 min lockout)
- Fastify API server + Telegram Mini App (setup, unlock, send, receive, history)
- One-time seed reveal via Mini App or auto-deleted DM message
- Federated registry client
- Docker Compose deployment

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,28 @@
+# ── Telegram ──────────────────────────────────────────────────────────────────
+BOT_TOKEN=
+
+# ── Breez SDK ─────────────────────────────────────────────────────────────────
+BREEZ_API_KEY=
+
+# ── Database ──────────────────────────────────────────────────────────────────
+# SQLite (default)
+DATABASE_URL=sqlite:./data/bot.db
+# Postgres alternative:
+# DATABASE_URL=postgresql://user:pass@localhost:5432/botdb
+
+# ── Federated registry (optional) ────────────────────────────────────────────
+REGISTRY_URL=
+REGISTRY_WRITE_KEY=
+REGISTRY_READ_KEY=
+
+# ── Session ───────────────────────────────────────────────────────────────────
+SESSION_SWEEP_INTERVAL_MS=60000
+
+# ── Bot identity ──────────────────────────────────────────────────────────────
+BOT_INSTANCE_NAME=gbnbot
+
+# ── Mini App ──────────────────────────────────────────────────────────────────
+# WEBAPP_URL must be a public HTTPS URL (Telegram requirement for Mini Apps).
+# Point your reverse proxy (nginx/Caddy) to WEBAPP_PORT.
+WEBAPP_PORT=8458
+WEBAPP_URL=https://yourbot.example.com