DisallowUnknownFields rejected real Telegram payloads (entities, from, date, etc. that our minimal structs don't cover). Lenient decode is the right default for an upstream webhook we don't control.
