feat: max-bot-test initial — full surface coverage

- Slim 4 PSR-15 webhook, PHP-DI 7, Symfony Console 8
- 13 update handlers, 30+ command scenarios, all 7 button types
- Composer pulls pkirillw/max-bot-api-php from GitHub vcs
- Multi-stage Dockerfile (php-fpm 8.4-alpine) + nginx
- docker-compose.yml targets server (npm_default external)
- docker-compose.override.yml for local dev (gitignored)
- .gitea/workflows/deploy.yml mirrors ghost-blog-bot pattern

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/Command/SubscribeWebhookCommand.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Command;
+
+use App\Bootstrap;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+#[AsCommand(name: 'webhook:subscribe', description: 'POST /subscriptions — register this bot webhook with MAX.')]
+final class SubscribeWebhookCommand extends AbstractCommand
+{
+
+    protected function configure(): void
+    {
+        $this->addOption('url', 'u', InputOption::VALUE_OPTIONAL, 'Override WEBHOOK_URL from env');
+        $this->addOption('secret', 's', InputOption::VALUE_OPTIONAL, 'Override MAX_BOT_API_SECRET from env');
+        $this->addOption('types', 't', InputOption::VALUE_OPTIONAL, 'Comma-separated update types (default: empty = all)');
+    }
+
+    protected function doExecute(SymfonyStyle $io, InputInterface $input, OutputInterface $output): int
+    {
+        $config = Bootstrap::envConfig();
+        $url = (string) ($input->getOption('url') ?: $config['webhook.url']);
+        $secret = (string) ($input->getOption('secret') ?: $config['bot.secret']);
+        $typesArg = $input->getOption('types');
+        $types = $typesArg === null ? [] : array_values(array_filter(explode(',', (string) $typesArg)));
+
+        if ($url === '' || str_contains($url, 'your-tunnel-host')) {
+            $io->error('WEBHOOK_URL is empty or still default. Run `make logs-tunnel` to read the cloudflared URL and put it in .env.');
+            return self::FAILURE;
+        }
+        if ($secret === '') {
+            $io->error('MAX_BOT_API_SECRET is empty. Generate one (e.g. `openssl rand -hex 32`) and put in .env.');
+            return self::FAILURE;
+        }
+
+        $io->text("Subscribing $url with " . ($types === [] ? 'all update types' : 'types: ' . implode(',', $types)));
+        $result = $this->api->subscriptions->subscribe($url, $types, $secret);
+        if (!$result->success) {
+            $io->error('Subscribe failed: ' . ($result->message ?? 'unknown'));
+            return self::FAILURE;
+        }
+        $io->success('Subscribed. Verifying via getSubscriptions()…');
+
+        $subs = $this->api->subscriptions->getSubscriptions();
+        $rows = [];
+        foreach ($subs->subscriptions as $s) {
+            $rows[] = [$s->url, $s->version ?? '—', implode(',', $s->updateTypes) ?: '(all)'];
+        }
+        $io->table(['url', 'version', 'update_types'], $rows);
+
+        return self::SUCCESS;
+    }
+}