Subagent re-review: fix confirmed misses, harden thin tests

Fix regressions found by adversarial review: routing, rendering, rate limits

Security wave 2: gate deploy on push+own repo, 401 and denial logging on admin endpoints, FastAPI schema off, proxy body cap, ownerless pick confined to chat, loud warning about secrets derived from BOT_TOKEN

Revert guest_message removal (valid Bot API Update field, guest mode) + dependabot grouping

Move tests to tests/ and proxy to proxy/, update CI and docs paths