Phase 2c — testing infrastructure (43 tests, CI gating, docker-compose)

Brings the project to a TDD/BDD-friendly state — apologies for shipping
Phase 1.5 + Phase 2 code-first, that violated feedback_tdd_first_bdd_required.

What's added :

- helpers_test.go : FakeTelegram (httptest server that records sendMessage /
  deleteMessage / setWebhook / etc.), miniredis bootstrap, MakeUpdate /
  PostWebhook helpers. The same harness simulates 'a user DMing the bot'
  end-to-end without hitting Telegram cloud — answer to the user question.
- 43 tests covering : allowlist parsing, telegram type helpers (UserID /
  ChatID / Text / messageID), secret_token constant-time compare, Backoff
  schedule, Auth (login wrong/right/logout/TTL/nil-receiver), EchoHandler,
  HTTPHandler (forward / timeout / non-2xx / empty body), AuthHandler
  (start / auth / whoami / logout / replay defense delete), Server (bad
  secret 401, unknown bot 404, allowlist drop, gated bot prompt,
  full /auth → echo → /logout flow, healthz/readyz).
- All tests pass with -race in 1.6s, no external deps (miniredis +
  httptest in-process).

Infra :

- Updated .gitea/workflows/dockerimage.yaml : new 'test' job
  (go vet + go test -race) gates the build-and-push-image job. CI now
  also runs on pull_request.
- docker-compose.yml : redis + postgres for full local stack.
- Makefile : test-race, compose-up/down targets.
- README updated with test + local-dev sections.

Refs ~/.claude/plans/pour-les-notifications-on-inherited-seal.md § Phase 2.

README.md

@@ -27,21 +27,40 @@ Telegram → Cloudflare Tunnel (tg.arcodange.fr) → Service telegram-gateway:80
 
 ## Local dev
 
+Pour le dev local complet (Redis pour l'auth + Postgres pour la queue) :
+
 ```bash
-# 1. Provide a config + env
+make compose-up   # docker compose up -d --wait : redis + postgres
+export REDIS_URL=redis://localhost:6379/0
+export DATABASE_URL=postgres://gateway:gateway@localhost:5432/gateway?sslmode=disable
+export AUTH_SECRET=$(openssl rand -hex 16)
+export ALLOWED_USERS=<your-tg-user-id>
 export BOT_FACTORY_TOKEN='8737289837:…'                # from @BotFather
 export BOT_FACTORY_SECRET=$(openssl rand -hex 32)
-
-# 2. Run
 make run                                                # uses bots.example.yaml
+```
 
-# 3. Smoke a webhook
+Smoke d'un webhook (sans Telegram cloud) :
+
+```bash
 curl -X POST -H "X-Telegram-Bot-Api-Secret-Token: $BOT_FACTORY_SECRET" \
      -H 'Content-Type: application/json' \
-     -d '{"update_id":1,"message":{"chat":{"id":<your-chat-id>},"text":"hi"}}' \
+     -d '{"update_id":1,"message":{"message_id":1,"from":{"id":<tg-id>},"chat":{"id":<tg-id>},"text":"hi"}}' \
      http://localhost:8080/bot/factory
 ```
 
+## Tests
+
+```bash
+make test         # unit + integration (in-process miniredis + httptest mock Telegram)
+make test-race    # avec race detector
+make vet
+```
+
+43 tests couvrent : allowlist parsing, secret comparison, auth flow (login/logout/whoami/replay-defense), echo handler (plain/slash/empty), http handler (forward/timeout/non-2xx/empty), webhook dispatch (bad secret 401, unknown bot 404, allowlist drop, gated bot prompt, full /auth → echo flow).
+
+Pour des smokes locaux contre une vraie API Telegram, voir la section "Local dev" ci-dessus.
+
 ## Set / delete webhook
 
 ```bash