feat: middleware, MCP server, and CLI tool for v3.4

[wrxck]

Summary

• Middleware system — api.use(fn) for global middleware, api.middleware.on_message.use(fn) for scoped. Onion model with (ctx, next). Zero overhead when none registered.
• MCP server — JSON-RPC 2.0 over stdio with 23 curated Telegram Bot API tools and telegram://bot/info resource. Works with Claude Code, Cursor, and other MCP clients.
• CLI tool — bin/tgbot with subcommands: send, info, updates, chat, ban, unban, mcp, run. Reads BOT_TOKEN from env. Installed via LuaRocks.
• Version bump to 3.4-0 with new rockspec.

New files

File	LOC	Purpose
src/middleware.lua	~120	Middleware engine
src/mcp.lua	~375	MCP JSON-RPC server
bin/tgbot	~170	CLI tool
spec/middleware_spec.lua	14 tests	Middleware ordering, scoping, early return, errors
spec/mcp_spec.lua	21 tests	JSON-RPC parsing, tool dispatch, resources, serve loop
spec/cli_spec.lua	10 tests	Arg parsing, subcommand validation, error handling
telegram-bot-lua-3.4-0.rockspec	—	New rockspec with middleware, mcp modules and bin

Modified files

• src/main.lua — version bump, loads middleware + mcp modules
• src/handlers.lua — refactored process_update() to route through middleware chain
• spec/test_helper.lua — added module mappings for middleware + mcp

Test plan

• 45 new unit tests pass
• All 567 existing tests still pass (612 total, 31 redis failures are pre-existing auth issue)
• 0 luacheck warnings
• MCP server verified end-to-end with piped JSON-RPC
• Cross-spec contamination tested (middleware state cleanup)
• CLI error handling tested (missing token, missing args, unknown commands)