fix: audit cleanup — ReDoS guard, Telegram validation, README accuracy

- form_filler.mjs: reject regex patterns over 200 chars to mitigate ReDoS
- notify.mjs: check res.ok before parsing Telegram API response
- README: update project structure with new lib/apply/ modules, session.mjs,
  keywords.mjs; fix max_applications_per_run docs (no limit by default);
  clarify ATS stub status in roadmap

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/notify.mjs

@@ -32,6 +32,7 @@ export async function sendTelegram(settings, message) {
       }),
     });
     lastSentAt = Date.now();
+    if (!res.ok) { console.error(`[notify] Telegram HTTP error: ${res.status}`); return; }
     const data = await res.json();
     if (!data.ok) console.error('[notify] Telegram error:', data.description);
   } catch (e) {