fix: audit cleanup — ReDoS guard, Telegram validation, README accuracy

- form_filler.mjs: reject regex patterns over 200 chars to mitigate ReDoS
- notify.mjs: check res.ok before parsing Telegram API response
- README: update project structure with new lib/apply/ modules, session.mjs,
  keywords.mjs; fix max_applications_per_run docs (no limit by default);
  clarify ATS stub status in roadmap

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/form_filler.mjs

@@ -23,6 +23,7 @@ export class FormFiller {
     // Check custom answers first (user-defined, pattern is substring or regex)
     for (const entry of this.answers) {
       try {
+        if (entry.pattern.length > 200) throw new Error('pattern too long');
         const re = new RegExp(entry.pattern, 'i');
         if (re.test(l)) return String(entry.answer);
       } catch {

lib/notify.mjs

@@ -32,6 +32,7 @@ export async function sendTelegram(settings, message) {
       }),
     });
     lastSentAt = Date.now();
+    if (!res.ok) { console.error(`[notify] Telegram HTTP error: ${res.status}`); return; }
     const data = await res.json();
     if (!data.ok) console.error('[notify] Telegram error:', data.description);
   } catch (e) {