security: remove all hardcoded paths, usernames, IPs, and chat IDs from tracked files

- start.sh: use dirname instead of hardcoded path
- src/zcode.js: remove hardcoded chat_id fallback
- src/utils/rtk.js: use 'rtk' from PATH instead of hardcoded binary path
- src/telegram-bot.ts: use process.cwd() instead of hardcoded path
- TELEGRAM_SETUP.md: replace token/chat_id with placeholders
- QUICKSTART.md: sanitize all references
- SERVICE_MAP.md: use relative paths instead of absolute

TELEGRAM_SETUP.md

@@ -6,10 +6,10 @@ Your zCode CLI X Telegram bot is now **live and running 24/7**!
 
 ## 📊 Current Configuration
 
-- **Bot Token**: `8745650761:AAFX1almFpesJYOCWkqsJL7UWfiVab_eYwQ`
-- **Allowed Users**: `6352861167`
-- **API**: Z.AI GLM-5.1 (7 models available)
-- **Port**: 3001
+- **Bot Token**: Configured via `.env` (`TELEGRAM_BOT_TOKEN`)
+- **Allowed Users**: Configured via `.env` (`TELEGRAM_ALLOWED_USERS`)
+- **API**: Z.AI GLM-5.1 (Coding Plan)
+- **Port**: Configured via `ZCODE_PORT` (default: 3001)
 - **Service**: systemd (auto-start on boot)
 
 ## 🚀 How to Use
@@ -17,7 +17,7 @@ Your zCode CLI X Telegram bot is now **live and running 24/7**!
 ### Via Telegram
 
 1. Open Telegram
-2. Search for your bot (name not set yet)
+2. Search for your bot
 3. Send `/start` to initialize
 4. Start chatting!
 
@@ -28,7 +28,7 @@ Your zCode CLI X Telegram bot is now **live and running 24/7**!
 sudo systemctl status zcode
 
 # View logs
-tail -f /home/uroma2/zcode-cli-x/logs/zcode.log
+tail -f logs/zcode.log
 
 # Restart service
 sudo systemctl restart zcode
@@ -49,12 +49,12 @@ Webhook is **configured and active**. To receive real messages:
 2. Set the webhook URL:
    ```bash
    curl -F "url=https://your-domain.com/telegram/webhook" \
-     "https://api.telegram.org/bot8745650761:AAFX1almFpesJYOCWkqsJL7UWfiVab_eYwQ/setWebhook"
+     "https://api.telegram.org/bot<YOUR_TOKEN>/setWebhook"
    ```
 
 3. Verify webhook:
    ```bash
-   curl "https://api.telegram.org/bot8745650761:AAFX1almFpesJYOCWkqsJL7UWfiVab_eYwQ/getWebhookInfo"
+   curl "https://api.telegram.org/bot<YOUR_TOKEN>/getWebhookInfo"
    ```
 
 ## 🛠️ Available Commands