Fix bot reliability, error handling, and user experience issues

[Copilot]

Multiple production issues identified: crashes on missing usernames, incorrect SQL syntax, missing input validation, and poor UX for new users.

Core Fixes

Username handling - Users without Telegram usernames caused @undefined display. Now falls back to first_name or user ID:

const userName = info.user.username 
    ? `@${info.user.username}` 
    : (info.user.first_name || `User ${info.user.id}`);

SQL syntax - Incorrect table-qualified column references in UPDATE statements:

// Before: points.points - 1 (invalid)
// After:  points - 1
await sql`UPDATE points SET points = points - 1 WHERE...`

Negative points protection - Added validation to prevent removing points below zero with proper boundary check (< 1 vs <= 0)

Error boundaries - Wrapped all command handlers and callbacks in try-catch blocks to prevent crashes

UX Improvements

• Added /start and /help commands (bot had no user guidance)
• Empty leaderboards now show friendly message instead of blank output
• Input validation on ability names (max 100 chars, trimmed)
• Graceful shutdown handlers (SIGINT/SIGTERM) for clean database disconnection

Quality

• Typo fix: "addeded" → "added"
• Fixed /list command early return bug
• Updated README from 3 lines to full documentation
• CodeQL scan: 0 vulnerabilities

Original prompt

find the shortcomings of the bot and fix them

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.