fix(tgbot): treat messages sent on behalf of a chat as strangers

Telegram fills a message's From with one of three fixed placeholder
users whenever it is posted on behalf of a chat, by an anonymous group
admin or a channel. The level gate and the invite claim took that
placeholder for the account acting, so it got a throttle window of its
own, and a claim bound the client to an id every anonymous admin shares.

Such a message is rated as a stranger whatever the placeholder id is
bound to, and its invite claim is refused before it is counted or bound.

internal/web/service/tgbot/tgbot_level_test.go

@@ -79,6 +79,24 @@ func TestGateCommand(t *testing.T) {
 	}
 }
 
+// Regression test: a message sent on behalf of a chat carries a placeholder user
+// shared by everybody, so whatever that id is bound to, its sender is a stranger.
+func TestGateCommandIgnoresPlaceholderSender(t *testing.T) {
+	tb, calls := newLevelTgbot(t)
+
+	for _, from := range []int64{ownerTgID, 1} {
+		message := commandFrom(from, "/usage "+ownerMail)
+		message.Chat = telego.Chat{ID: -100200, Type: telego.ChatTypeSupergroup}
+		message.SenderChat = &message.Chat
+		if isAdmin, ok := tb.gateCommand(message); ok || isAdmin {
+			t.Errorf("gateCommand(%d for a chat) = (%v, %v), want (false, false)", from, isAdmin, ok)
+		}
+	}
+	if n := calls("sendMessage"); n != 0 {
+		t.Errorf("sendMessage calls = %d, want 0", n)
+	}
+}
+
 // Regression test: a stranger's forged callback must be answered, so the button
 // stops spinning, and must never reach answerCallback.
 func TestGateCallbackStopsStrangers(t *testing.T) {