Telegram webhook unreachable on dev: route

Found in Task 7091 (item 8, live dev check). The Telegram bot's webhook is registered at the console origin (`telegram_bot.webhook_url` → `Settings.frontend_url` + `/api/public/telegram/updates`). On dev that ALB admits only the admin prefix list (`infra/jaah/terraform/modules/ecs/public-ui.tf`, `public_ui_admins_only`), so Telegram's servers can never deliver an update. A user taps Start and the link stays `pending` (reproduced 2026-10-18 with `@jaahai_bot` designated on dev). Prod is open to the internet, so it works there. Ask: make the webhook reachable in every environment without opening dev's console. Preferred: serve `WEBHOOK_PATH` on the hooks edge (`hooks.<env>.jaah.ai`, `modules/ecs/hooks-ingress.tf` allow-list) and have `webhook_url` use the hooks host. The alternative is admitting Telegram's published webhook CIDRs (149.154.160.0/20, 91.108.4.0/22) for that path only. Update ADR-0084 and the `telegram_bot` module docstring to match. Then run the live dev check: link → receive a task question with a working console link → unlink → receive nothing. Out of scope: Telegram message content; Slack/email delivery. Done means: - On dev, Profile › Notifications › Telegram › Connect → Start links the chat (state `linked`). - A task question reaches the linked chat with a console link that opens the task; after Disconnect nothing arrives. Screenshots and the Telegram message in the report. - terraform plan shown, `./dc check full` green.

The Telegram webhook is now served on the hooks edge (ALB, nginx and selftest) and registered on HOOKS_PUBLIC_BASE_URL; ADR-0084 updated. PR #5785 is merged and deployed to dev. Live check passed: Start linked the chat, a task question arrived, nothing came after Disconnect. Full gate: 274 stages green; Playwright smoke red on 7 org/access/tenant specs outside this diff. Filed draft #7149 (UI follow-ups). Used mem-18030.