refactor: drop the slash-command bot — Mini App is the only interface

bot.py is gone. /start, /history, /stats, /delete, /export,
/feedback, and the text-message workout parser are no longer
exposed. Everything those commands did is already available in
the Mini App (history listing, stats, edit/delete, JSON export
via /api/export/json, etc.).

Why: prod runs behind a Mini App URL, and shipyard staging is a
tenant under the existing shipyard_poc_bot which polls Telegram
itself. A second polling process on the same token would 409. By
removing polling entirely, prod and staging share one
architecture: a pure HTTP server validated against whatever
BOT_TOKEN is provided.

Changes:
- delete bot.py
- start.py: stop spawning the bot subprocess; load token, start
  server, optionally start cloudflared. WEBAPP_URL still skips
  the tunnel.
- flake.nix / requirements.txt: drop python-telegram-bot.
- README: rewrite to reflect Mini-App-only architecture.

The prod systemd unit doesn't need to change — its ExecStart is
`python start.py`, which now boots only the server (+ no tunnel
since WEBAPP_URL is set in the unit env).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -1,14 +1,13 @@
 # BigBiggerBiggestBot 💪
 
-A Telegram bot for logging gym workouts, with an embedded Mini App.
-
-Send workouts as plain text, forward them from Saved Messages, or tap
-through a structured log form inside Telegram. History, stats, notes,
+A Telegram **Mini App** for logging gym workouts. History, stats, notes,
 edit & delete, JSON/CSV export — all per-user, all in SQLite.
 
-## Format
+The slash-command bot was removed: the Mini App is the only interface.
+A Telegram bot identity (token) is still required so the Mini App can
+validate user sessions via `initData` HMAC.
 
-Send messages like:
+## Workout text format (still supported via "Paste as text" in the Mini App)
 
 ```
 Bench press: 4x8x35
@@ -23,15 +22,6 @@ Pull-ups: 3x10
 - Blank line separates superset groups; consecutive lines form a superset
 - Both `,` and `.` work as decimal separators
 
-## Commands
-
-- `/start` — help & open Mini App
-- `/history` — recent workouts
-- `/stats` — summary (total workouts, sets, volume)
-- `/delete <id>` — soft-delete a workout
-- `/export` — download all data as JSON
-- `/feedback <text>` — send feedback to the bot author
-
 ## Run locally
 
 ```bash
@@ -39,9 +29,9 @@ nix run
 ```
 
 This launches:
-- API server (port 8080)
-- cloudflared tunnel for the Mini App
-- Telegram bot (polling)
+- API + Mini App server (port 8080)
+- cloudflared Quick Tunnel for a public HTTPS URL (skipped if `WEBAPP_URL`
+  is already set in the environment, e.g. fronted by a reverse proxy)
 
 Put your bot token (from [@BotFather](https://t.me/BotFather)) in
 `~/.secrets/bigbiggerbiggestbot` or a `.env` file:
@@ -63,10 +53,12 @@ nix develop --command pytest tests/ -v
 Two environments share one host (`sunken-ship`):
 
 - **Production** — `fitness-bot.service`, working dir `/home/danny/tg_fitness_bot`,
-  watches `origin/main`, served behind a stable URL via the VPS Caddy.
+  watches `origin/main`, served behind a stable URL via the VPS Caddy at
+  `https://bbbot.dannydannydanny.me`.
 - **Shipyard staging** — `fitness-bot-shipyard.service`, working dir
-  `/home/danny/tg_fitness_bot_shipyard`, watches `origin/staging`, separate
-  bot token, ephemeral cloudflared URL each restart.
+  `/home/danny/tg_fitness_bot_shipyard`, watches `origin/staging`, served
+  by the shared `shipyard_poc_bot` Telegram bot (B3Bot beta is the active
+  POC tenant).
 
 Each has its own pull timer that fetches every ~15 minutes and restarts
 the service when its branch has new commits.
@@ -74,7 +66,6 @@ the service when its branch has new commits.
 **Workflow:**
 
 ```
-# 1. land changes on a working branch (or main locally)
 git push origin <branch>:staging   # → shipyard auto-deploys, test there
 git push origin <branch>:main      # → production auto-deploys
 ```
@@ -84,13 +75,16 @@ so testing on shipyard never touches production data.
 
 ## Architecture
 
-- `bot.py` — Telegram command handlers, polling, message parsing
-- `server.py` — aiohttp REST API + static file server for the Mini App
-- `db.py` — SQLite data layer (workouts, supersets, exercises, feedback; soft delete)
-- `parser.py` — workout text → structured data
-- `webapp/` — Mini App (HTML/CSS/vanilla JS, Telegram WebApp SDK)
-- `start.py` — orchestrator: starts server + tunnel + bot, wires up the Mini App URL
-- `tests/` — pytest suite for parser + db
+- `server.py` — aiohttp REST API + static file server for the Mini App;
+  validates Telegram `initData` HMACs against the bot token.
+- `db.py` — SQLite data layer (workouts, supersets, exercises, feedback,
+  events, settings; soft delete).
+- `parser.py` — workout text → structured data (used by the Mini App's
+  "Paste as text" path).
+- `webapp/` — Mini App (HTML/CSS/vanilla JS, Telegram WebApp SDK).
+- `start.py` — orchestrator: loads token, starts server, optionally starts
+  cloudflared.
+- `tests/` — pytest suite for parser + db.
 
 ## License