(security): auto-generate webhook secret when unset, redact token in tgapi standalone logs (fix): webhookLogger nil panic, dead warning block (tests): update secret-path test for new auto-gen behaviour (doc): CHANGELOG v1.0.1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

utils.go

@@ -1,6 +1,9 @@
 package laniakea
 
 import (
+	"crypto/rand"
+	"encoding/base64"
+
 	"git.scuroneko.dev/scuroneko/laniakea/utils"
 )
 
@@ -27,3 +30,11 @@ const (
 	// VersionBeta re-exports the module prerelease counter.
 	VersionBeta = utils.VersionBeta
 )
+
+func generateToken(b int) (string, error) {
+	bytes := make([]byte, b)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(bytes), nil
+}