Phase 2b — durable Postgres queue + worker (gated on DATABASE_URL)

Adds the async dispatch infrastructure :

- Postgres pool + embedded migration (CREATE TABLE/INDEX IF NOT EXISTS
  gateway_jobs). Auto-applied at boot. lib/pq driver (matches webapp
  convention).
- queue.go : Enqueue (idempotent on UNIQUE(bot_slug, update_id) — handles
  Telegram redelivery), Pop with FOR UPDATE SKIP LOCKED, MarkDone,
  MarkFailed with exponential backoff (30s → 2m → 10m → 1h → dead at 5).
- worker.go : goroutine that drains the queue, dispatches via the same
  Handler interface as sync, schedules retries on failure, notifies the
  user once when a job goes to dead.
- BotConfig gains `async: bool`. Registry refuses bots with async=true
  if DATABASE_URL is unset (queue=nil).
- Server : when bot.Async, the webhook ack is immediate ; the update
  payload is enqueued for the worker.

When DATABASE_URL is unset (current default), queue/worker stay disabled
and only sync handlers (echo, http, auth) work — no breaking change to
the running cluster.

Refs ~/.claude/plans/pour-les-notifications-on-inherited-seal.md § Phase 2.

main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"database/sql"
 	"errors"
 	"flag"
 	"log"
@@ -46,6 +47,26 @@ func runServer() {
 
 	tg := NewTelegramClient()
 
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	// Phase 2b — durable queue (Postgres) + worker. Disabled when
+	// DATABASE_URL is unset ; bots with `async: true` then fail config validation.
+	var queue Queue
+	var db *sql.DB
+	if dbURL := os.Getenv("DATABASE_URL"); dbURL != "" {
+		var err error
+		db, err = OpenDB(ctx, dbURL)
+		if err != nil {
+			log.Fatalf("init db: %v", err)
+		}
+		defer func() { _ = db.Close() }()
+		queue = NewPostgresQueue(db)
+		log.Printf("queue + schema ready (db=%s)", RedactDSN(dbURL))
+	} else {
+		log.Print("DATABASE_URL unset → queue/worker disabled (sync handlers still work)")
+	}
+
 	// Phase 1.5 — auth layer (Redis-backed sessions). See
 	// factory/doc/adr/20260509-telegram-gateway-auth.md.
 	authSecret := os.Getenv("AUTH_SECRET")
@@ -77,23 +98,25 @@ func runServer() {
 		log.Printf("allowlist active (%d user(s) allowed)", allowlist.Size())
 	}
 
-	registry, err := NewRegistry(cfg, tg, auth)
+	registry, err := NewRegistry(cfg, tg, auth, queue)
 	if err != nil {
 		log.Fatalf("build registry: %v", err)
 	}
 
+	if queue != nil {
+		worker := NewWorker(queue, registry, tg)
+		go worker.Run(ctx)
+	}
+
 	srv := &http.Server{
 		Addr:              *addr,
-		Handler:           NewServer(registry, auth, allowlist, tg).Routes(),
+		Handler:           NewServer(registry, auth, allowlist, tg, queue).Routes(),
 		ReadHeaderTimeout: 5 * time.Second,
 		ReadTimeout:       30 * time.Second,
 		WriteTimeout:      30 * time.Second,
 		IdleTimeout:       60 * time.Second,
 	}
 
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer stop()
-
 	go func() {
 		log.Printf("telegram-gateway listening on %s (%d bot(s) loaded)", *addr, registry.Count())
 		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {