ci(deploy): auto-register Telegram webhook + commands after SAM deploy

Append two steps to .github/workflows/deploy.yml that POST setWebhook
and setMyCommands against the freshly-deployed Function URL, reading
credentials from SSM. Mirrors `make telegram-setup` but inlined to
avoid the Makefile's --profile admin assumption.

Token and webhook-secret are masked via ::add-mask:: before any echo.
Jobs fail loudly on Telegram API errors via `jq -e .ok`.

Mark the manual setWebhook snippets in docs/deploy-aws.md and
docs/deploy-aws-free-tier-guide.md as break-glass.

docs/deploy-aws-free-tier-guide.md

@@ -258,6 +258,8 @@ aws cloudformation describe-stacks --profile admin \
 
 ## Step 5 — Point Telegram at the webhook
 
+> For first-time setup only. After `Step 6` wires the GitHub workflow, every push to `main` auto-runs `setWebhook` + `setMyCommands`; this manual block is the break-glass path.
+
 ```sh
 URL=…   # from previous command
 TOKEN=$(aws ssm get-parameter --profile admin \

docs/deploy-aws.md

@@ -53,6 +53,8 @@ curl -fsSL "$(...)/" | jq .                       # health JSON
 
 ## Set the Telegram webhook
 
+> `.github/workflows/deploy.yml` auto-runs `setWebhook` + `setMyCommands` after every push to `main`. The snippet below is the break-glass equivalent for manual / out-of-band fixes (e.g. rerun from a workstation when CI is unavailable).
+
 ```sh
 URL=$(aws cloudformation describe-stacks --stack-name miti99bot \
         --query "Stacks[0].Outputs[?OutputKey=='FunctionUrl'].OutputValue" --output text)