fix(tgbot): treat messages sent on behalf of a chat as strangers

Telegram fills a message's From with one of three fixed placeholder
users whenever it is posted on behalf of a chat, by an anonymous group
admin or a channel. The level gate and the invite claim took that
placeholder for the account acting, so it got a throttle window of its
own, and a claim bound the client to an id every anonymous admin shares.

Such a message is rated as a stranger whatever the placeholder id is
bound to, and its invite claim is refused before it is counted or bound.

internal/web/service/tgbot/tgbot_invite_test.go

@@ -216,6 +216,45 @@ func TestInviteAttemptLimit(t *testing.T) {
 	}
 }
 
+// Regression test: anonymous admins, channels and linked-channel posts all arrive
+// under three fixed user ids. A claim under one opened a throttle window of its
+// own and bound the client to everybody who can post that way.
+func TestClaimSentForChatIsRefused(t *testing.T) {
+	tb, calls := newInviteTgbot(t, "invitee@x")
+
+	origBy := inviteAttemptsBy
+	inviteAttemptsBy = map[int64]*inviteAttempts{}
+	t.Cleanup(func() { inviteAttemptsBy = origBy })
+
+	placeholders := []telego.User{
+		{ID: 1087968824, IsBot: true, Username: "GroupAnonymousBot"},
+		{ID: 136817688, IsBot: true, Username: "Channel_Bot"},
+		{ID: 777000, FirstName: "Telegram"},
+	}
+	for _, from := range placeholders {
+		message := commandFrom(from.ID, "/start "+mustInvitePayload(t, "sub-invite"))
+		message.From = &from
+		message.Chat = telego.Chat{ID: -1001234500001, Type: telego.ChatTypeSupergroup}
+		message.SenderChat = &message.Chat
+
+		if isAdmin, ok := tb.gateCommand(message); ok {
+			tb.answerCommand(message, message.Chat.ID, isAdmin)
+		}
+		if got := tb.levelOf(from.ID); got != levelStranger {
+			t.Errorf("placeholder user %d claimed the invite: level %d", from.ID, got)
+		}
+	}
+	if len(inviteAttemptsBy) != 0 {
+		t.Errorf("throttle windows = %d, want none for placeholder users", len(inviteAttemptsBy))
+	}
+	if n := calls("sendMessage"); n != len(placeholders) {
+		t.Errorf("sendMessage calls = %d, want %d refusals", n, len(placeholders))
+	}
+	if outcome, _ := tb.resolveInviteToken("sub-invite", 8080); outcome != inviteBindable {
+		t.Errorf("owner's outcome afterwards = %d, want bindable", outcome)
+	}
+}
+
 func TestTgUserMentionEscapesName(t *testing.T) {
 	got := tgUserMention(&telego.User{ID: 42, FirstName: "<b>Eve</b>", Username: "eve"})
 	want := `<a href="tg://user?id=42">&lt;b&gt;Eve&lt;/b&gt;</a> @eve`