Fix broken reply-history mapping; harden web dashboard

[klept0]

Summary

Full review found and fixed the following, highest priority first:

• Reply/history mapping was broken on every queued forward. MessageForwardService.forward_message/forward_album returned the source message as a placeholder when queuing a send (the real send happens later, asynchronously). Forward._forward_message/_forward_album then used that placeholder to record history, storing (source_chat, source_id) -> (source_chat, source_id) instead of the real destination mapping — silently breaking reply-threading, since Telegram always constructs a real queue. Fixed via an on_sent callback that fires with the actual sent message once the queue worker sends it; added regression tests for the queued path (tests/test_forwarding_service.py).
• requirements.txt was missing deps web/app.py needs (fastapi, uvicorn, jinja2, pydantic, python-dotenv, loguru, aiofiles) and pinned an obsolete typing backport that can break stdlib typing on 3.10+.
• Web dashboard /api/* routes had no authentication and bound to 0.0.0.0 by default — added a required X-API-Key check (fails closed if API_KEY unset) and switched the default bind to 127.0.0.1.
• Web dashboard's startup handler checked env vars the app never populates and did nothing (pass) — telegram_client was never initialized. It now reuses the session created by the CLI (python main.py) via Credentials.get_all() + Telegram.create().
• Removed source/utils/RateLimiter.py (RateLimitedQueue) — zero references anywhere.
• Removed the postgres/redis/prometheus docker-compose.yml services — unused by any app code, and two of them referenced ./docker/postgres/init.sql / ./docker/prometheus.yml, which don't exist in the repo (their profiles would fail to start).
• Removed dead env vars (TELEGRAM_API_ID, TELEGRAM_API_HASH, TELEGRAM_PHONE, BOT_TOKEN, LOG_LEVEL, LOG_FILE, MAX_CONCURRENT_TASKS, MESSAGE_QUEUE_DELAY, SECRET_KEY) from .env.example/docker-compose.yml — none were ever read by the app.
• Credentials.py now reuses Constants.CREDENTIALS_FILE_PATH instead of a separately hardcoded path, and writes the file 0600 (contains a plaintext api_hash).
• Cleaned up a no-op try/except in Bot.start() and silent exception-swallowing in main.py's shutdown().
• Updated README.md/CHANGELOG.md to match.

Test plan

• pytest tests/ — 16/16 pass (includes 2 new regression tests for the history-mapping fix)
• ruff check — clean
• black --check on touched files (reformatted the 2 files with new code)
• Verified web/app.py imports and registers all routes with the new deps
• Verified the X-API-Key auth dependency: 503 with no API_KEY set, 401 on missing/wrong key, 200 with the correct key