Make the miniapp a standalone web app with messenger admin login

[sadfun]

Wirebot's settings UI previously required Telegram, including in Slack-only and Discord-only deployments. This adds a standalone browser app at /app with bookmarkable Settings, Skills, and Schedules URLs, while preserving Telegram's Mini App and signed authentication.

• Admins request a private, one-use link with /web in Telegram or /wirebot web in Slack/Discord. Links expire in 5 minutes; browser sessions last 12 hours. Slack/Discord /config uses this flow when a public URL is available, retaining its native picker otherwise.
• Credentials are random and hashed; sessions use Secure, HttpOnly, SameSite cookies. API routes share one authentication gate, connector admin access is rechecked, and logout/restart revoke sessions. Schedule ownership and delivery stay tied to the originating messenger account and private conversation.
• Browsers get independent light/dark themes, a desktop sidebar, mobile navigation, safe areas, accessible controls, and Safari editor viewport handling. Browser themes use CSS. Startup authenticates once before mounting the app; the settings form owns its loaded and saved snapshot. The sign-in screen reuses existing UI components; Telegram's SDK loads only for Telegram launches.

Validation: 25 Bun tests, TypeScript/Biome checks, compilation, and the binary version smoke test pass. Desktop Chromium and mobile WebKit checks pass for sign-in, deep links/history, themes/layout, unsaved changes, editor resizing, logout, and replay rejection. Additional browser checks cover consecutive versioned saves, fresh tab snapshots, logout failure/retry, and session revocation. A simulated Telegram launch verifies signed auth, live theme changes without losing drafts, and bottom navigation. Physical iOS hardware and live messenger delivery were not exercised.

Local checks used the available Bun 1.3.14 and existing dependencies. CI uses the pinned Bun 1.4.0 with a frozen lockfile and now runs the test suite.