feat(telegram): bot bonuri fiscale — OCR → preview → Oracle write

- US-001: mută queue_client.py în data_entry/services/ocr/
- US-002/003/004: oracle_receipt_writer + oracle_server_id în DB
- US-005: receipt_handlers.py (PDF/photo/callback flow)
- US-006: wire handlers în main.py, per-schema connect, seq_cod.nextval
- US-007: .gitignore secrets/*.oracle_pass
- US-008/009/010: teste unit + integration + E2E
- setup-secrets.sh helper + template
- docs/telegram/README.md actualizat cu arhitectura nouă

Testat E2E pe DB live (MARIUSM_AUTO). COD din seq_cod.nextval.
pypdfium2 fallback pentru PDF decode (fără poppler).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitignore

@@ -433,8 +433,9 @@ run_tests.*
 scan_*.json
 sdist/
 sdist/
-secrets/
-# Allow documentation in secrets directories
+# Match any secrets/ folder anywhere in the tree (root, backend/, etc.)
+**/secrets/*
+# Allow README documentation inside any secrets/ directory
 !**/secrets/README.md
 security_*.json
 share/python-wheels/
@@ -530,3 +531,12 @@ backend/data/ocr_queue/
 # Handoff document (session continuity, not for version control)
 .claude/HANDOFF.md
 .gstack/
+
+# Ralph runtime state (logs, locks, branch tracking, usage stats)
+scripts/ralph/.last-branch
+scripts/ralph/.ralph.pid
+scripts/ralph/logs/
+scripts/ralph/screenshots/
+scripts/ralph/archive/
+scripts/ralph/usage.jsonl
+.claude/scheduled_tasks.lock