fix: harden the debug command, link cache and rate limiter

- commands: /bot_dict dumped the whole chat state to any member of the chat
  and could exceed Telegram's 4096-char message limit (the send then failed
  and bubbled up as a handler error). It is now admin-only and capped at
  MAX_DEBUG_DUMP_CHARS; README, README.en and the /help description updated.
- send: the edit-before-forward template buttons were built from a HashMap
  walk, so their order changed between prompts. Now sorted by name.
- link_cache: an unparseable payload (older schema) was reported as a miss
  but left in place, re-failing the parse on every later hit; the row is
  dropped on read.
- handlers: a link handed to the URL workers after the channel closed
  (shutdown) was discarded silently; it is now logged.
- rate_limit: LIMITERS kept one bucket per chat that ever sent media,
  forever. The periodic sweep now drops buckets that are idle (refilled to
  capacity) and not held by an in-flight sender; acquire's refill was
  factored into a shared helper used by the idle check.

Tests: +3 (corrupted row dropped, sorted markup, idle-bucket pruning); the
cache one was verified to fail before the fix. fmt/clippy clean, 55 + 69.

crates/xmedia-bot/src/handlers/commands.rs

@@ -31,7 +31,7 @@ pub(crate) enum Command {
         parse_with = "split"
     )]
     SetTemplate(String),
-    #[command(description = "Show chat state (debug)")]
+    #[command(description = "Show chat state (debug; admin only)")]
     BotDict,
     #[command(description = "Set site caption format", parse_with = "split")]
     SetFormat(String),
@@ -226,9 +226,28 @@ pub(crate) async fn execute_command(
             reply(bot, message.chat.id.0, message.id, text).await?;
         }
         Command::BotDict => {
+            // Debug dump of the chat's persisted state: admin only (it echoes
+            // forward-channel ids and templates to whoever asks).
+            let sender_id = message
+                .from
+                .as_ref()
+                .map(|user| user.id.0 as i64)
+                .unwrap_or(-1);
+            if !CONFIG.admin_ids.contains(&sender_id) {
+                reply(bot, message.chat.id.0, message.id, "Admin only.").await?;
+                return Ok(());
+            }
             let chat_data = CHAT_STORE.get(message.chat.id.0).await;
-            let debug = format!("{chat_data:?}");
-            let text = html_escape::encode_text(&debug).into_owned();
+            let debug = html_escape::encode_text(&format!("{chat_data:?}")).into_owned();
+            // A chat with many templates/edit records exceeds Telegram's 4096
+            // char message limit; the dump is plain text (no parse mode), so a
+            // plain byte-boundary cut is safe.
+            let end = debug.floor_char_boundary(MAX_DEBUG_DUMP_CHARS.min(debug.len()));
+            let text = if end < debug.len() {
+                format!("{}…", &debug[..end])
+            } else {
+                debug
+            };
             reply(bot, message.chat.id.0, message.id, text).await?;
         }
         Command::SetFormat(arg) => {
@@ -389,6 +408,10 @@ pub async fn register_commands(bot: &Bot) -> Result<(), RequestError> {
 /// it even for very large threads (many media lines + a long caption).
 const MAX_TEST_REPORT_CHARS: usize = 4000;
 
+/// Cap for the `/bot_dict` debug dump: the state is echoed as one plain-text
+/// message, so it must stay under Telegram's 4096-char limit.
+const MAX_DEBUG_DUMP_CHARS: usize = 3500;
+
 /// Builds the HTML report for the `/test` command: what the parser produced
 /// for a link (site, canonical URL, title/author/tags, caption and the media
 /// list) — no media is sent and nothing is cached or forwarded. Sent with

crates/xmedia-bot/src/handlers/mod.rs

@@ -157,7 +157,12 @@ pub async fn message_handler(bot: Bot, message: Message) -> Result<(), RequestEr
                 log::warn!("url workers not started; dropping link");
                 break;
             };
-            let _ = tx.send((message.clone(), url)).await;
+            // A closed channel means the workers are stopping (shutdown):
+            // report the dropped link instead of losing it silently.
+            if tx.send((message.clone(), url)).await.is_err() {
+                log::warn!("url workers stopped; dropping link");
+                break;
+            }
         }
     }
     respond(())