security: remove all hardcoded paths, usernames, IPs, and chat IDs from tracked files

- start.sh: use dirname instead of hardcoded path
- src/zcode.js: remove hardcoded chat_id fallback
- src/utils/rtk.js: use 'rtk' from PATH instead of hardcoded binary path
- src/telegram-bot.ts: use process.cwd() instead of hardcoded path
- TELEGRAM_SETUP.md: replace token/chat_id with placeholders
- QUICKSTART.md: sanitize all references
- SERVICE_MAP.md: use relative paths instead of absolute

src/telegram-bot.ts

@@ -136,7 +136,7 @@ class TelegramBot {
       const { spawn } = await import('child_process');
 
       const childProcess = spawn('node', ['dist/cli.mjs', '--print', text], {
-        cwd: '/home/uroma2/zcode-cli-x',
+        cwd: process.cwd(),
         env: {
           ...process.env,
           TELEGRAM_USER_ID: String(userId),

src/utils/rtk.js

@@ -6,7 +6,7 @@ import { logger } from './logger.js';
  */
 export class RTKIntegration {
   constructor() {
-    this.rtkPath = process.env.RTK_PATH || '/home/uroma2/.local/bin/rtk';
+    this.rtkPath = process.env.RTK_PATH || 'rtk';
     this.enabled = false;
     this.version = null;
   }

src/zcode.js

@@ -42,7 +42,8 @@ export async function zcode(options) {
     bot = await botModule.initBot(config, api, tools, skills, agents);
     if (bot) {
       deliveryTargets.set('telegram', bot.send);
-      registerChannel('telegram', (msg) => bot.send(env.TELEGRAM_ALLOWED_USERS?.split(',')[0] || '6352861167', msg));
+      const defaultChat = env.TELEGRAM_ALLOWED_USERS?.split(',')[0];
+      if (defaultChat) registerChannel('telegram', (msg) => bot.send(defaultChat, msg));
       logger.info('✓ Telegram bot initialized');
     }
   }