ops: run the Telegram bots and the assistant on vps3 (#46)

* ops: run the Telegram bots and the assistant on vps3

telegram-bot and ask ran on the free cloud project, which paused itself
after a quiet week; every bot went silent and the deploy job failed against
the paused project. They now run in their own edge-runtime container on vps3
(bots/), from /opt/pezkuwi-bots.

Separate from the shared functions runtime because that one verifies a JWT
on every request, which Telegram cannot send, and holds the platform's wallet
keys, which a public bot feeding user text to a language model should not
sit next to. The new runtime holds only the keys the two functions read.

- telegram-bot refuses updates without Telegram's secret-token header
  (TELEGRAM_WEBHOOK_SECRET); the main slot reads TELEGRAM_BOT_TOKEN_MAIN,
  since TELEGRAM_BOT_TOKEN on vps3 is the miniapp's sign-in check.
- nginx keeps the public URL shape:
  supabase.pezkuwichain.io/functions/v1/{telegram-bot,ask}.
- deploy.yml ships them with a new bots-deploy verb on the existing deploy
  key; the host script accepts exactly main, telegram-bot and ask, restarts
  the container and fails unless the bot comes back refusing unsigned updates.
- Registry: _cloud_hosted becomes _hosted_elsewhere; the gate refuses those
  names in the shared volume and reports any copy there as stale.

* ask: send the legacy service key as a bearer token on vps3

The vps3 gateway has no opaque sb_secret keys and honours the service_role JWT
only as a bearer token; sent on apikey alone it reads as anon, the limiter's
count fails, and every question is refused as rate-limited.

.github/workflows/deploy.yml

@@ -63,10 +63,8 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      # telegram-bot and ask are excluded on purpose: both Telegram bots and the
-      # news.pex.mom assistant are served from the cloud project, not from here.
-      # Stale copies of both still sit in this volume from before that split and
-      # take no traffic. They are deployed by the deploy-cloud-functions job.
+      # telegram-bot and ask are excluded on purpose: they run in their own
+      # runtime (bots/, deployed by the deploy-bots job), not in this volume.
       - name: Package functions
         run: |
           tar czf functions.tgz -C supabase \
@@ -96,30 +94,32 @@ jobs:
           fi
           ssh -i "$RUNNER_TEMP/deploy_key" -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$RUNNER_TEMP/known_hosts" miniapp-deploy@217.77.6.126 deploy < functions.tgz
 
-  # The two Telegram bots and the news.pex.mom assistant run on the cloud
-  # Supabase project, reached by webhook at
-  # vbhftvdayqfmcgmzdxfv.supabase.co/functions/v1/telegram-bot?bot=krd|dks.
-  # These were deployed by hand for months, which let the source in git drift
-  # behind what was actually running — badly enough that on 2026-07-21 the live
-  # function body had to be pulled back out of the deployed bundle to recover it.
-  deploy-cloud-functions:
-    name: Deploy edge functions (cloud)
+  # The Telegram bots' webhook (telegram-bot) and the assistant behind
+  # news.pex.mom and ick.pezkiwi.app (ask) run in their own runtime on vps3,
+  # /opt/pezkuwi-bots (bots/ here), reached at
+  # supabase.pezkuwichain.io/functions/v1/{telegram-bot,ask}. Until 2026-10-22
+  # they ran on the free cloud project, which pauses itself after a quiet week
+  # and took every bot down with it.
+  deploy-bots:
+    name: Deploy bots runtime
     needs: deploy
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - name: Deploy telegram-bot and ask
-        env:
-          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+      - name: Package bots
         run: |
-          set -e
-          if [ -z "$SUPABASE_ACCESS_TOKEN" ]; then
-            echo "::error::SUPABASE_ACCESS_TOKEN is not set — the bots would silently keep running old code"
-            exit 1
-          fi
-          for fn in telegram-bot ask; do
-            npx --yes supabase@latest functions deploy "$fn" \
-              --project-ref vbhftvdayqfmcgmzdxfv \
-              --no-verify-jwt
-          done
+          mkdir bundle
+          cp -r bots/main bundle/main
+          cp -r supabase/functions/telegram-bot supabase/functions/ask bundle/
+          tar czf bots.tgz -C bundle ask main telegram-bot
+
+      - name: Deploy to vps3
+        env:
+          DEPLOY_KEY: ${{ secrets.MINIAPP_FUNCTIONS_DEPLOY_KEY }}
+          KNOWN_HOST: "217.77.6.126 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxxRmMEYyng+B9O3jcUCMnUa31SyWQ+l7aj18/soWtJ"
+        run: |
+          umask 077
+          printf '%s\n' "$DEPLOY_KEY" > "$RUNNER_TEMP/deploy_key"
+          printf '%s\n' "$KNOWN_HOST" > "$RUNNER_TEMP/known_hosts"
+          ssh -i "$RUNNER_TEMP/deploy_key" -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile="$RUNNER_TEMP/known_hosts" miniapp-deploy@217.77.6.126 bots-deploy < bots.tgz