fix(bot): remove redundant deposit amount step, add Visa/MC label, Mercuryo auth note, enforce product completeness

- Remove deposit amount-selection step; deposit_wallet_<TYPE> now routes directly to instruction
- Add VISA / Mastercard text to Mercuryo card button (i18n en/es/de)
- Add deposit_important5: Mercuryo 1-payment-without-auth + top-up-reserve warning
- Admin validation: description + photo required on product create/update (products.js, catalogProducts.js)
- Cleanup orphan uploaded files on validation failure (catalogProducts.js)
- Bot guards: fallback to products.no_description / products.no_photo for incomplete products
- Add vitest + 7 purchase edge-case tests (src/__tests__/userProductHandler.test.js)
- Bump version to v1.2.1

VERSION.md

@@ -9,10 +9,19 @@
 
 ## Current Version
 
-**v1.2.0** — 2026-07-08
+**v1.2.1** — 2026-07-18
 
 ## Changelog
 
+### v1.2.1 — 2026-07-18
+- **refactor**: Removed deposit amount-selection step (redundant); deposit_wallet_ now goes directly to Mercuryo instructions
+- **feat**: Updated Mercuryo button text to include VISA/Mastercard branding in all locales
+- **feat**: Added deposit_important5 note about Mercuryo authorization limits and top-up reserve
+- **fix**: Enforced description + photo required in admin product create/update routes (products.js, catalogProducts.js)
+- **fix**: Added defensive guards in bot purchase display — description fallback and no-photo placeholder (userProductHandler.js)
+- **feat**: Added i18n keys `products.no_description` and `products.no_photo` in en/es/de
+- **fix**: Marked description and photo fields as required in admin forms (product-edit.ejs, products.ejs, catalog modal)
+
 ### v1.2.0 — 2026-07-08
 - **fix**: Disabled CSRF checks in admin panel for Tor / onion zone compatibility
 - **fix**: Fixed "Invalid wallet type" error in Telegram bot purchase flow (`main`/`bonus` types added to validator)