Companion bot requires its own dedicated token (companionBotToken) - never the shared CTBRewards_Bot token; allowlist the new config key

tgbot.js

@@ -2,7 +2,7 @@
 // payout pings. Deliberately additive — private-chat updates only (the same
 // bot keeps posting group feeds untouched), no wallet actions ever, all state
 // in one JSON file on the volume. Uses the raw Bot API via fetch; token comes
-// from config (companionBotToken overrides telegramBotToken when set).
+// from config key companionBotToken ONLY (see hard rule below).
 'use strict';
 const fs = require('fs');
 const path = require('path');
@@ -14,7 +14,11 @@ const FILE = () => path.join(DATA_DIR, 'tg-links.json');
 function load() { try { return JSON.parse(fs.readFileSync(FILE(), 'utf8')); } catch (e) { return { u: '', members: {}, chats: {}, codes: {}, rmap: {} }; } }
 function save(d) { try { fs.writeFileSync(FILE(), JSON.stringify(d)); } catch (e) { console.error('tgbot save', e.message); } }
 
-function token() { const c = getConfig(); return String(c.companionBotToken || c.telegramBotToken || '').trim(); }
+// HARD RULE: the companion runs ONLY on its own dedicated bot token. The
+// shared telegramBotToken belongs to @CTBRewards_Bot (group feeds + the CTB
+// Rewards project) — registering a webhook on it breaks CTB's bot. Until
+// companionBotToken is set in config, every companion feature is a no-op.
+function token() { const c = getConfig(); return String(c.companionBotToken || '').trim(); }
 function webhookSecret() { const t = token(); return t ? crypto.createHash('sha1').update('tg-hook:' + t).digest('hex').slice(0, 24) : ''; }
 
 async function api(method, payload) {