Add public mode with channel membership requirements

Completes TODO #2. PUBLIC_MODE swaps the ALLOWED_USERS allowlist for a
membership check against REQUIRED_CHATS, with REQUIRE_MODE choosing
between needing every chat or just one.

- Stop is_admin() falling back to "everyone is an admin" when
  ADMIN_USERS is unset once PUBLIC_MODE is on. That fallback is the
  original single-owner convenience, but under public mode it handed
  moderation, /edit and /delete to anyone who found the bot. Public
  mode now grants admin to nobody until ADMIN_USERS is set, and says
  so at startup. Private deployments are unaffected.
- Cache membership answers: inline search queries on every keystroke,
  so an uncached check meant several API calls per typed character.
  Grants last five minutes, refusals thirty seconds, so a user who has
  just joined is not locked out for the full window.
- Fail closed when the membership check errors, and validate
  REQUIRED_CHATS at startup so a chat the bot cannot read is reported
  rather than silently refusing every user.
- Refused users get a join prompt with real links instead of silence;
  inline shows a tappable bar that opens the bot and explains why.
  A private bot stays silent as before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -4,3 +4,14 @@ ADMIN_USERS=123456789
 
 # Let non-admin users submit media for moderator approval (default: off)
 ACCEPT_SUBMISSIONS=false
+
+# Open the bot to anyone who meets the membership requirement below,
+# instead of using the ALLOWED_USERS list (default: off)
+PUBLIC_MODE=false
+
+# Chats a user must belong to. @username or numeric id, comma-separated.
+# The bot must be an admin in each one. Leave empty for a fully open bot.
+REQUIRED_CHATS=
+
+# all = must be in every chat listed above, any = one is enough
+REQUIRE_MODE=all