fix(core): resolve multiple bugs across plugins and middleware

• Move hardcoded Tenor API key to config (TENOR_API_KEY)
• Fix restrict_chat_member arg order in wordfilter, join_captcha (permissions as 3rd arg, opts as 4th); replace deprecated permission names with modern granular permissions
• Fix UTF-8 iteration in flip.lua and aesthetic.lua using proper codepoint pattern instead of byte-level iteration
• Replace blocking socket.sleep with copas.pause in purge plugin; batch message deletion using delete_messages API (groups of 100)
• Fix callback_query handler creating empty chat context for inline buttons; now creates minimal valid context with sender's ID and private type
• Fix config parser stripping inline # comments from quoted .env values
• Implement SpamWatch API integration in blocklist middleware with Redis caching (was dead code stub)