feat: add admin report callback for join requests

[TheOnlyOne001]

Summary

• Add a Report inline button to join-request challenge messages
• Verify the tapping user is a group admin with getChatMember before accepting a report
• Persist each report as an append-only Cloudflare KV record keyed by chat, reported user, timestamp, and reporter for future export
• Answer callback queries for success, non-admin taps, and admin verification failures

Notes

Telegram inline keyboards are rendered the same way for every viewer in a group, so the bot cannot make a button visually appear only for admins. This PR enforces the admin-only requirement at the bot/API boundary before writing anything to KV.

Fixes #26

Validation

• cargo fmt --all -- --check
• cargo check
• cargo test
• cargo check --target wasm32-unknown-unknown
• git diff --check

[woahwhattheheck]

Focused source follow-up to your existing implementation, with the exact proposed patch inline. Original attribution is retained. Runtime validation and whole-issue acceptance remain unperformed.

Claim correction (2026-10-09): My bounty/payment claim for the specific diagnosis and proposed correction recorded in this review remains ACTIVE. I demand payment for my contribution under the applicable bounty terms. Please confirm the review outcome, any specific remaining acceptance requirement, and the payment date. Original feature authorship and other contributors' claims remain with their respective authors; this payment demand concerns my own contribution. Recipient: Bryce / Token Junkie Labs, @woahwhattheheck. I will provide the verified receiving details through the project's official payment channel. No waiver, withdrawal, transfer, or split of my claim is authorized.

[woahwhattheheck]

Distinct callback queries processed for the same chat, reported user, administrator and whole-second timestamp currently alias the same Workers KV key. Appending Telegram's unique callback query ID preserves separate callbacks and avoids that shared-key overwrite/rate-limit path. Your administrator authorization, report JSON and acknowledgement flow are retained. This is not exactly-once delivery: the same callback processed in a later second can still create another record. Key-parsing consumers must allow the trailing callback ID. No Rust/Worker/KV/Telegram runtime check has been run.

Exact proposed follow-up against current head e9f0f12717e19299ece63486712a19f1147b2b32:

diff --git a/src/bot.rs b/src/bot.rs
--- a/src/bot.rs
+++ b/src/bot.rs
@@ -260,7 +260,11 @@
             join_message_id: msg.message_id.0,
             reported_at,
         };
-        let key = report_key(msg.chat.id, reported_user_id, reporter_id, reported_at);
+        let key = format!(
+            "{}:{}",
+            report_key(msg.chat.id, reported_user_id, reporter_id, reported_at),
+            callback_query_id
+        );
         let value = serde_json::to_string(&entry).map_err(|e| Error::RustError(e.to_string()))?;
         self.kv.put(&key, value)?.execute().await?;
 

Original implementation credit remains with this PR's author. AI-assisted source review; no bounty or whole-issue acceptance claim.