fix(security): add authorization and input validation for menu and preferences

[JonasBaeumer]

Closes #91

Summary

• Intent ownership checks: menu_cancel_confirm, menu_cancel_do, and menu_card_cancel now run after the user lookup and verify intent.userId === user.id before acting. Forged or replayed callback payloads from other users get an error menu instead.
• Enum validation: menu_pref_policy validates the payload against Object.values(CardCancelPolicy) before casting, preventing invalid values from being written to the DB.
• Auth on preferences endpoint: PATCH /v1/users/:userId/preferences now requires a valid Bearer token (userAuthMiddleware) and a matching userId. Returns 401 without auth, 403 for a different user. Writes a PREFERENCES_UPDATED audit event on success.
• Null guard in callbackHandler: Replaced chatId!/messageId! non-null asserts with an explicit if (chatId === undefined || messageId === undefined) return; guard to prevent silent runtime crashes on inline keyboard callbacks.

Test plan

• All unit tests pass: npm test -- --testPathPattern=tests/unit
• New unit tests cover ownership failure (permission error message shown, action not taken) for all three cancel actions
• New unit test covers invalid CardCancelPolicy payload → error shown, no DB write
• Integration tests for preferences updated: now include auth setup, 401/403 coverage, and audit event assertion
• Integration tests require DB: docker compose up -d && npm run test:integration -- --testPathPattern=telegram/menuHandler

[georgyia]

This is very close to merge — the security intent/ownership + validation changes look correct.

Small blockers to address before merge:

• tests/integration/telegram/menuHandler.test.ts has 1 failing assertion: it expects a generic “went wrong” string, but the handler now returns the specific ⚠️ Intent not found. message. Please update the expectation so the suite is green.
• The same integration suite is gated on STRIPE_SECRET_KEY even though it mocks Telegram/BullMQ and only needs Postgres+Redis. Removing that gating will ensure these security tests actually run in CI/dev environments.

Once those two are fixed, I’m happy to approve.