fix(tgbot): keep the add-client draft with the chat that owns it (#6499)

* fix(tgbot): keep the add-client draft with the chat that owns it

The wizard held one package-level draft for the whole bot. Its steps run on
the ten-goroutine worker pool, so two admins adding a client at the same time
wrote into the same form: whichever step ran last decided the email, the
limits and the attached inbounds of a client the other chat went on to
create, and the attach picker mutated one shared slice from several
goroutines at once as well.

Each chat now gets its own draft, reached only through the chat that owns it
and held for the duration of a step, so a client is created from the values
its own chat collected.

* fix(tgbot): take the wizard's draft lock only for the wizard

A queued report tap held one of the ten worker slots while it waited on the
chat's draft, and every chat that reached answerCallback grew the draft map
even when the admin gate rejected it. Both follow from acquiring the draft
before the gate; the wizard's own steps are the only callers that read it.

The draft is now looked up under the same admin-and-wizard check, addClient
takes the draft its caller locked instead of looking it up again, a submit
drops the entry, and StopBot clears the map with the conversation states.

internal/web/service/tgbot/tgbot_draft_render_test.go

@@ -17,25 +17,23 @@ import (
 	"golang.org/x/text/language"
 )
 
+// clientDraftTestChatID is a chat id no other test drives, so the draft this
+// test fills cannot leak into them.
+const clientDraftTestChatID = -9001
+
 // Regression test: the draft is sent with ParseMode HTML, so Markdown markers
 // were rendered literally and an unescaped value could break the whole message.
 func TestClientDraftMessageRendersHTML(t *testing.T) {
-	origEmail, origComment, origTgID := client_Email, client_Comment, client_TgID
-	origTotalGB, origLimitIP, origExpiry := client_TotalGB, client_LimitIP, client_ExpiryTime
-	origInboundIDs := receiver_inbound_IDs
-	t.Cleanup(func() {
-		client_Email, client_Comment, client_TgID = origEmail, origComment, origTgID
-		client_TotalGB, client_LimitIP, client_ExpiryTime = origTotalGB, origLimitIP, origExpiry
-		receiver_inbound_IDs = origInboundIDs
-	})
+	draft := addClientDrafts.forChat(clientDraftTestChatID)
+	t.Cleanup(func() { addClientDrafts.reset(clientDraftTestChatID) })
 
-	client_Email = "a@b.c"
-	client_Comment = "<b>promo</b> & <10 GB>"
-	client_TgID = "42"
-	client_TotalGB, client_LimitIP, client_ExpiryTime = 0, 0, 0
-	receiver_inbound_IDs = nil
+	draft.email = "a@b.c"
+	draft.comment = "<b>promo</b> & <10 GB>"
+	draft.tgID = "42"
+	draft.totalGB, draft.limitIP, draft.expiryTime = 0, 0, 0
+	draft.receiverInboundIDs = nil
 
-	out := (&Tgbot{}).BuildClientDraftMessage()
+	out := (&Tgbot{}).BuildClientDraftMessage(draft)
 
 	if !strings.Contains(out, "<b>New client draft</b>") {
 		t.Errorf("draft title is not HTML markup: %q", out)
@@ -46,7 +44,7 @@ func TestClientDraftMessageRendersHTML(t *testing.T) {
 	if strings.Contains(out, "<b>promo</b>") {
 		t.Errorf("raw comment markup reached the message: %q", out)
 	}
-	if !strings.Contains(out, html.EscapeString(client_Comment)) {
+	if !strings.Contains(out, html.EscapeString(draft.comment)) {
 		t.Errorf("comment is not HTML-escaped: %q", out)
 	}
 }
@@ -104,10 +102,10 @@ func TestAddClientPromptsEscapeDraftValues(t *testing.T) {
 	url, texts := promptTexts(t)
 	swapTestBot(t, url)
 
-	origEmail, origComment := client_Email, client_Comment
+	draft := addClientDrafts.forChat(1)
 	origRunning := isRunning
 	t.Cleanup(func() {
-		client_Email, client_Comment = origEmail, origComment
+		addClientDrafts.reset(1)
 		isRunning = origRunning
 	})
 	isRunning = true
@@ -123,7 +121,7 @@ func TestAddClientPromptsEscapeDraftValues(t *testing.T) {
 	tb := &Tgbot{}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
-			client_Email, client_Comment = tc.value, tc.value
+			draft.email, draft.comment = tc.value, tc.value
 
 			tb.answerCallback(&telego.CallbackQuery{
 				ID:      "q1",