Mini App join funnel: startapp sponsor attribution + wallet-app handoff

- /app decodes startapp=<sponsorId>[_<angle>] -> unlinked visitors land on the
  sponsor squeeze page /join/<ref>?src=miniapp (linked members still go to
  their dashboard); no-invite prospects get a gold Join button -> /join-now
- tg-app.js: sync __rmcInTg flag; external links route out of the webview via
  openLink/openTelegramLink (wallet deep links reach the wallet app reliably)
- join-now.js in the webview leads with the MetaMask/Trust deep links (no
  injected wallet can exist there); ref + src survive into the wallet browser
- tgbot: links command + weekly digest include the t.me/<bot>/<short>?startapp
  Telegram-native invite once config.miniAppShortName is set (new PATCH key)
- Synced chat.js canned answer + AI prompt (prospects can join from the app)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/tg-app.js

@@ -7,6 +7,7 @@
   try { inTg = sessionStorage.getItem('rmcTg') === '1'; } catch (e) {}
   if (!inTg && (window.TelegramWebviewProxy !== undefined || /tgWebApp(Data|Platform)/.test(location.hash))) inTg = true;
   if (!inTg) return;
+  window.__rmcInTg = 1; // synchronous flag for page scripts (join-now.js etc.)
   try { sessionStorage.setItem('rmcTg', '1'); } catch (e) {}
 
   function boot() {
@@ -23,6 +24,23 @@
       bb.show();
       bb.onClick(function () { history.back(); });
     }
+    // External links must LEAVE the webview: wallet deep links (MetaMask/Trust)
+    // have to reach the wallet app, t.me links belong to Telegram itself, and
+    // explorers etc. open in the system browser. Same-origin links stay inside.
+    document.addEventListener('click', function (ev) {
+      var a = ev.target && ev.target.closest && ev.target.closest('a[href]');
+      if (!a) return;
+      var href = a.href || '';
+      if (!/^https?:/i.test(href)) return;
+      var ext = false;
+      try { ext = new URL(href).origin !== location.origin; } catch (e) {}
+      if (!ext) return;
+      ev.preventDefault();
+      try {
+        if (/^https:\/\/t\.me\//i.test(href) && tg.openTelegramLink) tg.openTelegramLink(href);
+        else tg.openLink(href);
+      } catch (e) { location.href = href; }
+    }, true);
   }
   if (window.Telegram && window.Telegram.WebApp) { boot(); return; }
   var s = document.createElement('script');