fix(reward): TG webhook 空 secret fail-fast + 首充奖励文案六语 15→7(终审必修)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/cmd/server/main.go

@@ -335,10 +335,14 @@ func mountV1(r chi.Router, sqlDB *sql.DB, rdb *redis.Client, nodeSvc *nodes.Serv
 	tgBotToken := os.Getenv("TG_REWARD_BOT_TOKEN")
 	tgEnabled := tgBotToken != ""
 	if tgEnabled {
+		tgWebhookSecret := os.Getenv("TG_WEBHOOK_SECRET")
+		if tgWebhookSecret == "" {
+			log.Fatal("TG_REWARD_BOT_TOKEN 已设置但 TG_WEBHOOK_SECRET 为空,/v1/tg/webhook 将无鉴权,拒绝启动")
+		}
 		rewardSvc.SetTelegram(
 			getenvDefault("TG_REWARD_BOT_USER", "pangolin_reward_bot"),
 			getenvDefault("TG_REWARD_CHANNEL", "@pangolin_app"),
-			tgBotToken, os.Getenv("TG_WEBHOOK_SECRET"))
+			tgBotToken, tgWebhookSecret)
 	}
 	rewardHandler := reward.NewHandler(rewardSvc, rewardStore, tgEnabled,
 		getenvDefault("TG_REWARD_CHANNEL", "@pangolin_app"))