Security fixes, ready-to-deploy image, and rewritten docs

Audit fixes:

- Wallet names were used unvalidated as file paths, so a name like
  "../<other-id>/x" reached another user's wallet directory or overwrote
  bot_settings.json. Names are now validated and every path is resolved and
  confirmed to sit inside the caller's own directory, which also blocks a
  planted symlink from escaping.
- Tor mode leaked: the mempool.space fee check opened a direct clear-net
  connection, tying the server's IP to its Bitcoin activity. It now goes
  through Tor's SOCKS proxy to mempool's onion service, DNS included.
- The xpub message was left in the chat forever. It reveals the wallet's whole
  address and balance history, so it is now deleted like the password is.
- Inline buttons stay live on old messages, so a user removed from the
  allow-list could keep using them. Callbacks re-check authorisation, and
  auth_check now works for callback queries instead of raising on a null
  message.
- Wallet names echoed back in callback_data are confirmed against the user's
  real wallet list.
- Settings are written via temp file + atomic rename; a crash mid-write used
  to truncate the file and lose every user's wallet selection.
- Replies were sent against messages that had just been deleted; deletion is
  now best-effort and cannot abort the flow.

Deployment:

- Allow-list can come from ALLOWED_USERS instead of a bind-mounted file, so a
  deployment needs no files on disk. Both sources merge when both are present.
- A missing bind-mounted allowed_users.txt made Docker create a directory in
  its place and silently lock everyone out; the entrypoint now detects that
  and stops with an explanation.
- Standard mode honours ELECTRUM_SERVER, which previously only worked in Tor
  mode despite being documented.
- Added VERSION, push.sh, docker-compose.deploy.yml and .env.deploy.example
  for a two-file deploy off the published image.

Docs rewritten in English and Persian around the name Telegtrum, leading with
the security model and what it does not protect against.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.deploy.yml

@@ -0,0 +1,31 @@
+# Ready-to-deploy Telegtrum. Pulls the published image — no source checkout,
+# no build, no bind mounts.
+#
+#   curl -O https://git.goyban.com/goyban/telegtrum_bot/raw/branch/main/docker-compose.deploy.yml
+#   curl -O https://git.goyban.com/goyban/telegtrum_bot/raw/branch/main/.env.deploy.example
+#   mv .env.deploy.example .env && nano .env
+#   docker compose -f docker-compose.deploy.yml up -d
+services:
+  telegtrum:
+    container_name: telegtrum
+    image: git.goyban.com/goyban/telegtrum:latest
+    env_file: .env
+    environment:
+      # Allow-list comes from .env, so there is no file to create or mount.
+      ALLOWED_USERS: ${ALLOWED_USERS:?set ALLOWED_USERS in .env - comma separated Telegram user IDs}
+      ALLOWED_USERS_FILE: /nonexistent
+    volumes:
+      # Wallets, Electrum config and the blockchain headers live here.
+      # Back this up: docker run --rm -v telegtrum-data:/d -v "$PWD":/b \
+      #   debian:bookworm-slim tar czf /b/telegtrum-backup.tar.gz -C /d .
+      - telegtrum-data:/root/.electrum
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "electrum", "getinfo"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+
+volumes:
+  telegtrum-data: