Fix docs accuracy + two real bugs found while verifying them

[klept0]

Summary

Follow-up to #1 (merged). While confirming the README/CHANGELOG were up to date against the current code, found and fixed two real functional bugs, plus corrected several stale doc claims:

Bugs found while verifying docs:

• web/app.py's home page 500'd on every load (TypeError: cannot use 'tuple' as a dict key) — templates.TemplateResponse("index.html", {"request": request}) is the old, removed Starlette calling convention on the pinned version. Fixed to TemplateResponse(request, "index.html").
• The dashboard's own frontend called every /api/* endpoint with a bare fetch(), so the X-API-Key auth requirement added in Fix broken reply-history mapping; harden web dashboard #1 broke the built-in UI (401 on every button and the initial status load). Added an apiFetch() wrapper that prompts for the key once, stores it in localStorage, and re-prompts on 401. Verified the full flow live (200 with correct key, 401 + cleared storage on wrong key).
• python-dotenv was a declared dependency that nothing ever called — cp .env.example .env had no effect on a plain python web/app.py run. Added load_dotenv() on startup.

Docs corrected:

• All three install paths said to "edit .env with your Telegram API credentials" — .env only ever holds web-dashboard settings; credentials are entered interactively and stored in resources/credentials.json. Corrected each path and noted the web dashboard/Docker web service need a session from running python main.py once first.
• ## Changelog Policy sat between two subsections of ## Usage, making ### Web API read as its child. Moved it under ## Contributing, restored ### Web API under ## Usage, documented the X-API-Key requirement there.
• Added docs/ and tests/ to the project tree, plus "Running Tests and Checks" / "Building Documentation" subsections matching what CI actually runs.

Test plan

• ruff check / ruff format --check — clean
• mypy source/ web/app.py — clean
• pytest tests/ — 16/16 pass
• Verified the dashboard live via a preview server: page loads (200, no more 500), apiFetch correctly attaches X-API-Key (200 with correct key, 401 + key cleared on wrong key)