fix: final review wave — public routes, inbox 419, url schemes, deep_link, tests

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw

core/tests/Feature/TelegramWebhookTest.php

@@ -43,6 +43,13 @@ class TelegramWebhookTest extends TestCase
         $this->postJson('/hooks/telegram', ['message' => []], ['X-Telegram-Bot-Api-Secret-Token' => 'wrong'])->assertStatus(403);
     }
 
+    public function test_public_route_sets_no_session_cookie(): void
+    {
+        $this->postJson('/hooks/telegram', ['message' => []])
+            ->assertStatus(403)
+            ->assertHeaderMissing('Set-Cookie');
+    }
+
     public function test_start_with_code_links_chat(): void
     {
         Cache::put('tg:link:ABC123', $this->user->id, 900);