Add /support with data deletion, Telegram API metrics, and a shared test container

[kozalosev]

Six independent changes that accumulated on one branch: one user-facing feature, two observability improvements, two fixes and a test-infrastructure change.

/support, and erasing a user's data (7b19ec1)

#19 asks for a way to leave a chat's rating, with a GDPR argument attached. An erasure option is a real obligation, but nothing requires it to be self-service — so the bot gets a contact channel and the owner answers a request by hand. This does not close #19: the per-chat opt-out it actually asks for is still open, and needs its own anti-abuse rule.

• /support relays a message to SUPPORT_CHAT_ID without exposing an email or a personal account. Two-step dialogue like /promo, private chats only, one message per user per minute, hidden from the menu when the variable is unset.
• Migrations 34–36: Users.banned_until, the erase_user / ban_user / unban_user functions for the owner to call from a DB client, and a trigger enforcing the ban.
• erase_user deletes every row a user owns but keeps the Users row — it carries the ban, and keeping it means none of the four foreign keys without ON DELETE CASCADE is violated. The retained id is what stops the deleted data coming back.
• The ban is 90 days rather than permanent, so exercising the right to erasure carries no lasting penalty while still removing the incentive to use it as a progress reset.
• Two layers enforce it: an in-memory list refreshed every BAN_LIST_REFRESH_SECS and on SIGHUP, and — because that list can be stale — a BEFORE UPDATE trigger on Users that is the actual guarantee.

Details, including why the trigger sits on Users and not Dicks, are in the wiki page.

Observability

51c87a5 — unique names for instrumented functions. The autometrics function label and the #[tracing::instrument] span name are both the bare Rust function name, so six callback_handlers, four cmd_handlers and three gets were indistinguishable in the Grafana latency panel and in traces. autometrics 3.0 offers no way to override the label, so the names themselves changed. Old series stop and new ones start from zero — the panels will show a break at the deploy.

4800220 — measure the Telegram API calls. Failed requests were counted but never timed, so a Telegram or DPI slowdown was invisible until it became an outright failure, and the BOT_HTTP_*_TIMEOUT_SECS values had to be picked blindly. Adds telegram_request_duration_seconds{method,outcome} (failures included, so a timeout is in the histogram rather than missing from it), a client span per call, and — on ApiError::Unknown — the serialized request body, which is the only way to learn which entity or over-long text was rejected.

Fixes

d11be57 — #92: can't parse entities: Unsupported start tag. The Dick of the Day "already chosen" message interpolated the winner's name straight from the SQL exception without escaping it, so a name containing < broke the whole message. Now escaped through Username::escaped(), with a test covering <, & and >.

3dba01a — get_me() was requested twice at startup.

Tests

2470af5 — one shared Postgres container. Every test used to start a throwaway container: 132 per run, and most of the suite's time. Now the binary starts one and each test takes a database out of it.

before  ~75s
after   ~35s   (132 passing, cold and warm)

Three things make it work, and each is load-bearing — CLAUDE.md records them along with two approaches that were tried and failed, so this doesn't get "simplified" back:

• the container and its maintenance pool live on a static runtime, because a #[tokio::test] runtime is torn down at the end of each test and a sqlx pool dies with it;
• migrations run once into a template database that each test copies;
• the container is marked reusable and outlives the run, so the next run finds it. task test:clean is now the only thing that removes it.

On CI nothing matches on a fresh runner, so it starts one and carries on — the cold path, still ~2x faster than before.

Deploying

• Migrations 34–36 apply automatically at startup. After that they must not be edited.
• New environment variables — SUPPORT_CHAT_ID (unset ⇒ /support hidden and inert) and BAN_LIST_REFRESH_SECS (default 900). Both still need adding to the server-configs repo — DickGrowerBot/docker-compose.yml and the value in .env.sops — or /support stays hidden in production.
• Grafana — the renamed functions in 51c87a5 and the new telegram_request_* metrics in 4800220 both touch the dashboard in server-configs.

🤖 Generated with Claude Code