feat: max-bot-test initial — full surface coverage

- Slim 4 PSR-15 webhook, PHP-DI 7, Symfony Console 8
- 13 update handlers, 30+ command scenarios, all 7 button types
- Composer pulls pkirillw/max-bot-api-php from GitHub vcs
- Multi-stage Dockerfile (php-fpm 8.4-alpine) + nginx
- docker-compose.yml targets server (npm_default external)
- docker-compose.override.yml for local dev (gitignored)
- .gitea/workflows/deploy.yml mirrors ghost-blog-bot pattern

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,24 @@
+# MAX Bot token from BotFather-like UI in MAX
+BOT_TOKEN=
+
+# Shared secret used to authenticate webhook requests from MAX.
+# Generated by `make subscribe` or any 32+ byte random string.
+MAX_BOT_API_SECRET=
+
+# Public HTTPS URL where MAX will POST updates.
+# Fill in with your own tunnel / reverse proxy / public hostname.
+WEBHOOK_URL=https://your-public-host.example/webhook
+
+# Optional: HTTPS URL of a web app registered against this bot in Botfather.
+# When empty, the OpenApp button is skipped in /keyboard (MAX returns 404 for unregistered apps).
+WEB_APP_URL=
+
+# Optional: when set, /debug on uses this chat for Debugs::sendText()
+DEBUG_CHAT_ID=
+
+# Self-test CLI target chat
+SELFTEST_CHAT_ID=
+
+# Diagnostics
+APP_ENV=dev
+APP_DEBUG=true