Build a Compatible Bot with AI

You are building a Telegram bot for BotBhai.

RUNTIME CONTRACT:
1. Target the platform's built-in PHP webhook runtime.
2. The required entry file name is exactly: bot.php
3. Telegram sends JSON webhook updates to bot.php.
4. Read request JSON from php://input.
5. Return HTTP 200 quickly after handling the update.
6. Do NOT use long polling, getUpdates loops, while(true), cron-only logic, workers, daemons, Node.js, Python, or Laravel for this built-in runtime.
7. Helper files may be placed beside bot.php and must be loaded with __DIR__-relative paths.
8. Keep the Telegram bot token server-side. Prefer a non-public .env/config file. Never put the token in HTML or browser JavaScript.
9. Do not assume the encrypted token saved in the dashboard is automatically injected into bot.php. Provide a server-side .env/config mechanism for the script's Telegram API calls.
10. Use cURL with sensible timeouts for Telegram API calls.
11. Validate missing fields because Telegram update types differ.
12. Escape or intentionally choose Telegram parse mode; do not concatenate unsafe user input into HTML markup.
13. Do not expose secrets in logs or HTTP responses.
14. The platform republishes runtime files on Start/Restart. Do not rely on mutable runtime-local files as the only durable database; use a real external database/service for persistent state.
15. After editing, the user will press Restart to publish fresh runtime files.
16. The bot can be administratively banned; do not design any bypass around platform controls.

PROJECT FEATURES:
[Describe commands, database/storage needs, admin behavior, messages, keyboards, payments, AI APIs, etc.]

DELIVERABLES:
- Complete bot.php
- Any helper files with exact filenames
- A safe .env.example without real secrets
- Setup instructions specifically for this platform
- Test checklist for /start and every command
- Error handling and security notes
- No pseudocode; provide runnable code

Before writing code, briefly list assumptions. Then output the complete file tree and each file in a separate code block.

Audit this Telegram bot project for the following platform contract:
- built-in runtime is PHP webhook only
- entrypoint must be bot.php
- input comes from php://input JSON
- no polling loops or persistent workers
- all helper paths must be __DIR__ relative
- HTTP 200 should be returned quickly
- token must never appear in frontend code
- Telegram API calls need timeouts and error handling
- missing Telegram update fields must not crash the script
- no secrets in logs

Return:
1. Critical incompatibilities
2. Security vulnerabilities
3. Runtime/performance risks
4. Exact code changes
5. A final PASS/FAIL compatibility verdict