(security): auto-generate webhook secret when unset, redact token in tgapi standalone logs (fix): webhookLogger nil panic, dead warning block (tests): update secret-path test for new auto-gen behaviour (doc): CHANGELOG v1.0.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tgapi/api.go

@@ -122,6 +122,7 @@ func NewAPI(opts *APIOpts) *API {
 		"API", utils.GetLoggerLevel(),
 		opts.logFormat, opts.logFormatter,
 	)
+	logger.AddReplacer(opts.token, "<TOKEN>")
 
 	client := opts.client
 	if client == nil {