Summary

This PR fixes #2065 by returning appropriate HTTP status codes when webhook requests are rejected:

• 405 Method Not Allowed for non-POST requests
• 404 Not Found for webhook path mismatches
• 403 Forbidden for secret token mismatches (unchanged behavior)

Previously, all rejection scenarios returned 403 Forbidden, which confused clients into thinking there was an authentication issue when the problem was actually a method or path mismatch.

Changes

1. src/core/network/webhook.ts: Added optional WebhookOptions parameter with path property. The default next callback now determines the appropriate status code based on:

   • Whether the request method is POST (405 if not)
   • Whether the path matches (404 if it doesn't)
   • Otherwise assumes authentication failure (403)

2. src/telegraf.ts: Updated webhookCallback() to pass the expected path to generateCallback.

3. test/telegraf.js: Added three test cases to verify the new status code behavior.

Backward Compatibility

This change is backward compatible:

• The WebhookOptions parameter is optional
• Custom webhookFilter implementations still work (they return boolean as before)
• The filter logic itself is unchanged - only the rejection status codes are now more specific

Testing

All existing tests pass, plus 3 new tests for the status code behavior:

• webhookCallback should return 405 for non-POST requests
• webhookCallback should return 404 for path mismatch
• webhookCallback should return 403 for secret token mismatch