auth Files

The Telegram provider no longer hard-codes https://api.telegram.org. NewTelegramAPIWithBaseURL takes the base, and every request goes through it, avatar downloads included. An empty base falls back to the public API.

Moving a token-bearing URL off a constant is what the rest of the change is for: the bot token travels in the request path, and the answers now come from a host the library does not control. The base is validated, error text is scrubbed of the token in raw and encoded forms, a success response has to match Telegram's own username shape, and redirects are refused by default because Go copies the previous URL into Referer.

One behaviour change. A caller that relied on the default redirect policy now gets an error on a redirect. A caller-supplied CheckRedirect remains in force.

Also in this release: the Apple public-key test no longer binds a shared port, and the Telegram tests no longer race or depend on order.

Full detail in [#316].