refactor(commands): the executor takes its context instead of the statics

execute_command reached for CHAT_STORE/LINK_CACHE/CONFIG in 16 places, which
is why the one handler body with no test could not have one: those statics
point at the real $DATA_DIR/task_queue.db, so any test would have written to
the developer's state. It now takes &AppContext (the shape handle_message
uses) and answers through the given sender; bot stays for what the
MediaSender surface does not carry (channel admin lookups, the HTML report).

Three tests cover what that unlocks: the settings/set_format round-trip
against the chat's own store (including the refused placeholder), the admin
gate on both admin-only commands, and /debug answering without sending.

crates/xmedia-bot/src/handlers/mod.rs

@@ -217,7 +217,7 @@ pub(crate) async fn handle_message(
             text.split_whitespace().next().unwrap_or("<empty>")
         );
         log::trace!("command text: {text_preview}");
-        execute_command(bot, &message, command).await?;
+        execute_command(ctx, bot, &message, command).await?;
         return respond(());
     }
     if is_private {