Phase 2b — durable Postgres queue + worker (gated on DATABASE_URL)

Adds the async dispatch infrastructure :

- Postgres pool + embedded migration (CREATE TABLE/INDEX IF NOT EXISTS
  gateway_jobs). Auto-applied at boot. lib/pq driver (matches webapp
  convention).
- queue.go : Enqueue (idempotent on UNIQUE(bot_slug, update_id) — handles
  Telegram redelivery), Pop with FOR UPDATE SKIP LOCKED, MarkDone,
  MarkFailed with exponential backoff (30s → 2m → 10m → 1h → dead at 5).
- worker.go : goroutine that drains the queue, dispatches via the same
  Handler interface as sync, schedules retries on failure, notifies the
  user once when a job goes to dead.
- BotConfig gains `async: bool`. Registry refuses bots with async=true
  if DATABASE_URL is unset (queue=nil).
- Server : when bot.Async, the webhook ack is immediate ; the update
  payload is enqueued for the worker.

When DATABASE_URL is unset (current default), queue/worker stay disabled
and only sync handlers (echo, http, auth) work — no breaking change to
the running cluster.

Refs ~/.claude/plans/pour-les-notifications-on-inherited-seal.md § Phase 2.

chart/values.yaml

@@ -105,6 +105,13 @@ auth:
   redisURL: "redis://redis.tools.svc.cluster.local:6379/0"
   sessionTTL: "24h"
 
+# Async queue (Phase 2b). Quand DATABASE_URL est dans le Secret cluster,
+# la queue Postgres + worker s'activent ; sinon tout reste sync (les bots
+# avec `async: true` font fail au boot — secure by default).
+# Format DSN attendu : postgres://USER:PASSWORD@pgbouncer.tools:6432/DBNAME?sslmode=disable
+# L'utilisateur doit avoir CREATE TABLE / CREATE INDEX sur la base cible
+# (le pod auto-applique les migrations idempotentes au démarrage).
+
 # k8s Secret consumed by `envFrom`. Phase 1: create it manually with kubectl.
 #   kubectl -n telegram-gateway create secret generic telegram-gateway-bots \
 #     --from-literal=BOT_FACTORY_TOKEN=…   --from-literal=BOT_FACTORY_SECRET=…