refactor(core): remove startup prewarm of Telegram SDK

- Eliminates unconditional outbound call to telegram.org on every start
- Fixes `go test ./internal/server` hitting real network during Manager construction
- Leaves background stale-refresh path intact in `refreshTelegramSDK`

Author: AppsGanin

internal/core/manager.go

@@ -289,8 +289,12 @@ func New(st *store.Store, sup *xray.Supervisor, opts xray.Options, tls TLSPaths,
 	m.startWebhookWorkers()        // drain the outbound-webhook delivery queue
 	go m.prewarmRoutingTemplates() // warm the routing-template cache so the first
 	//                                  Happ/INCY sub pull after a restart doesn't block
-	go m.refreshTelegramSDK() // warm telegram-web-app.js so the first subscription-page
-	//                             view doesn't pay for the fetch inline
+	// NOTE: telegram-web-app.js is deliberately NOT prewarmed here. The cold path in
+	// TelegramWebAppSDK fetches it inline and serves it, so a warm-up would only save
+	// the first subscription-page view ~120ms — not worth an unconditional outbound
+	// call to telegram.org on every single start (a beacon the decoy story doesn't
+	// cover, and one that made `go test ./internal/server` hit the real network,
+	// since its tests build a Manager through New).
 	// NOTE: the initial proxy-pool load is done synchronously by main.go via
 	// SeedProxies() before the first reconcile, so Xray starts once (with proxies)
 	// rather than starting empty and restarting when a background fetch lands.

internal/core/manager_settings.go

@@ -697,8 +697,9 @@ var telegramSDKFetch = func(ctx context.Context) ([]byte, error) {
 	return netguard.Get(ctx, telegramSDKURL, telegramSDKMaxBytes)
 }
 
-// refreshTelegramSDK fetches in the background (startup warm-up and stale refresh).
-// It's a no-op while a fetch is in flight OR while the failure cooldown is armed.
+// refreshTelegramSDK refreshes a stale copy in the background (the only caller —
+// there is no startup warm-up, see New). It's a no-op while a fetch is in flight OR
+// while the failure cooldown is armed.
 //
 // That cooldown is what stops a failing upstream from becoming a retry loop: a
 // failed fetch never advances tgSDKAt, so a stale copy stays stale and EVERY