chore(deploy): dedupe & regroup Gitea CI variables/secrets

Collapse identical TEST_/PROD_ pairs to single unprefixed Gitea entries, derive
the public URLs from PUBLIC_BASE_URL at deploy time, and share the prod env.sh
renderer between deploy and rollback.

- Collapse to one unprefixed variable: DICT_VERSION, SMTP_RELAY_HOST/PORT/TLS,
  GRAFANA_SMTP_PORT, VITE_VK_APP_LINK, VITE_VK_APP_ID (one Selectel relay + one
  pair of VK apps serve every contour). Secrets collapsed by the owner:
  SMTP_RELAY_USER/PASS, GATEWAY_VK_APP_SECRET, GATEWAY_VK_ID_CLIENT_SECRET.
- Derive at deploy from PUBLIC_BASE_URL (no longer stored): TELEGRAM_MINIAPP_URL,
  GRAFANA_ROOT_URL, VITE_VK_ID_REDIRECT_URL. Removes the prod/test asymmetry and
  fills the missing test VITE_VK_APP_ID (VK web login was half-configured on test).
- Extract deploy/write-prod-env.sh + write-prod-bot-env.sh, shared by prod-deploy
  and prod-rollback so the two cannot drift: a rollback now re-renders the FULL
  runtime env (email / VK login / Grafana alerts previously went dark after a
  rollback) and passes TELEGRAM_SUPPORT_CHAT_ID.
- Single-source DICT_VERSION (CI env + both deploys), fix the v1.3.0/v1.3.1 drift in
  .env.example/README, correct the misleading honeytoken/abuse-ban compose comment,
  and rewrite the deploy/README variable list (+ the previously undocumented
  GATEWAY_VK_APP_SECRET and TELEGRAM_SUPPORT_CHAT_ID).

The Gitea variables are reworked via the API; the stale TEST_/PROD_ entries are
deleted after the test contour goes green.

deploy/write-prod-bot-env.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Render the prod bot-host env.bot.sh from the workflow job environment.
+#
+# Sourced identically by prod-deploy (deploy-bot) and prod-rollback
+# (rollback-bot) so the two paths cannot drift (see deploy/write-prod-env.sh
+# for the same rationale on the main host).
+#
+# Usage:  BOT_IMAGE=<image ref> bash deploy/write-prod-bot-env.sh <out-path>
+#
+# Every other value comes from the caller's environment (the job `env:` block).
+out="${1:?usage: write-prod-bot-env.sh <out-path>}"
+
+# The bot's Mini App URL is the same public origin the SPA serves; derive it
+# rather than storing a second copy.
+base="${PUBLIC_BASE_URL%/}"
+TELEGRAM_MINIAPP_URL="$base/telegram/"
+
+cat > "$out" <<EOF
+export SCRABBLE_CONFIG_DIR='/opt/scrabble'
+export BOT_IMAGE='$BOT_IMAGE'
+export BOTLINK_GATEWAY_ADDR='$MAIN_HOST:9443'
+export TELEGRAM_BOT_TOKEN='$TELEGRAM_BOT_TOKEN'
+export TELEGRAM_MINIAPP_URL='$TELEGRAM_MINIAPP_URL'
+export TELEGRAM_GAME_CHANNEL_ID='$TELEGRAM_GAME_CHANNEL_ID'
+export TELEGRAM_CHAT_ID='$TELEGRAM_CHAT_ID'
+export TELEGRAM_SUPPORT_CHAT_ID='$TELEGRAM_SUPPORT_CHAT_ID'
+export TELEGRAM_PROMO_BOT_TOKEN='$TELEGRAM_PROMO_BOT_TOKEN'
+export TELEGRAM_BOT_USERNAME='$TELEGRAM_BOT_USERNAME'
+export TELEGRAM_BOT_LINK='$TELEGRAM_BOT_LINK'
+export LOG_LEVEL='${LOG_LEVEL:-info}'
+EOF