Telegram bot integration: design for duplicate updates and chat privacy

Bot updates can be retried, delayed, edited, or delivered out of order.

• Store update IDs and process them idempotently.
• Use chat and user IDs rather than display names.
• Verify webhook secret or protect long polling credentials.
• Handle edited messages, callbacks, membership changes, and blocked bots.
• Restrict commands by chat and authorization context.

Test group privacy mode, file download limits, callback expiry, rate limits, and restarts. Keep message content only as long as the feature needs it. Never let user text become an unchecked system command.