[codex] Keep Mini App tunnel warm

[ShawnPana]

What changed

• Add bux-miniapp-tunnel, a systemd-managed Cloudflare quick tunnel wrapper for the Mini App backend on 127.0.0.1:8787.
• Persist the generated public URL into /etc/bux/tg.env and restart bux-tg when it changes so /agency can reuse a warm URL.
• Start bux-miniapp and bux-miniapp-tunnel after Telegram install, and have /agency read the URL from process env, tg.env, or the tunnel state file.
• Repair bootstrap wiring for tg-schedule / tg-schedule-fire and existing agency.db ownership.

Why

The current /agency path creates a fresh trycloudflare.com tunnel inside the Telegram command handler. On a real bux box this failed with Mini App tunnel started but is not reachable yet ([Errno -2] Name or service not known) because the newly minted hostname was not DNS-reachable within the handler timeout.

Keeping the tunnel warm moves that fragile work out of the tap path. /agency can open a known URL, and the service refreshes the URL when cloudflared restarts.

Impact

This is still a tactical quick-tunnel approach, not a named tunnel or cloud-proxy architecture. It should make existing boxes and newly provisioned boxes much more reliable without requiring cloud-side routing changes.

Validation

• python3 -m unittest discover agent -p 'test*.py'
• python3 -m py_compile agent/bux-miniapp-tunnel agent/box_agent.py agent/telegram_bot.py agent/mini_app.py agent/agency_db.py
• bash -n agent/bootstrap.sh
• git diff --check

---

Summary by cubic

Keep the Mini App Cloudflare quick tunnel warm and reuse its public URL so /agency can launch reliably. This removes ad‑hoc tunnel creation in the Telegram handler and fixes DNS timing issues on real boxes.

• New Features

  • Added bux-miniapp-tunnel systemd service that runs cloudflared against 127.0.0.1:8787.
  • Persists the tunnel URL to /etc/bux/tg.env and /var/lib/bux/miniapp-tunnel/url, and restarts bux-tg when it changes.
  • /agency reads the URL from BUX_MINIAPP_PUBLIC_URL, tg.env, or the tunnel state file; telegram_bot waits briefly for it and starts both services when needed.
  • Wired into bootstrap and polkit; services are enabled but conditional on /etc/bux/tg.env.

• Bug Fixes

  • Restored tg-schedule/tg-schedule-fire symlinks and fixed ownership for existing agency.db*.
  • Tunnel only starts after the Mini App health check passes, reducing launch flakiness.

^{Written for commit 3f4df76. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 7 files