fix(bot): issue #127 — active-state sync, disabled-entity handling, double-tap lock, state reset

- BUG-01: getActiveLocationById + product availability checks (loc_active/cat_active) — disabled locations/categories filtered from bot menus
- BUG-02: graceful redirect to main menu (location_disabled notice) when entity disabled mid-flow, no crash in handleDistrictSelection/handleProductSelection/handleBuyProduct/handlePay
- BUG-03: per-user callback lock (LOCK_MS 1500ms debounce) in utils/callbackLock.js — duplicate taps dropped
- BUG-04: resetUserContext clears tracked photo/product messages + userStates on main-menu navigation and /start
- fix: handlePay uses validated numeric quantity (was raw string) for price/stock/purchase writes
- tests: 7 new (botBugFixes.test.js), updated userProductHandler tests — 30 total pass
- bump v1.2.2

VERSION.md

@@ -9,10 +9,17 @@
 
 ## Current Version
 
-**v1.2.1** — 2026-07-18
+**v1.2.2** — 2026-08-04
 
 ## Changelog
 
+### v1.2.2 — 2026-08-04
+- **fix**: BUG-01 — disabled locations/categories/subcategories filtered from bot menus (getActiveLocationById, is_active checks)
+- **fix**: BUG-02 — graceful handling of disabled entity during purchase flow (location_disabled notice + main-menu redirect, no crash)
+- **fix**: BUG-03 — per-user callback lock (1500ms debounce) prevents duplicate messages on double-tap
+- **fix**: BUG-04 — resetUserContext clears stale inline keyboards/state on main-menu navigation and /start
+- **fix**: handlePay uses validated numeric quantity for price/stock/purchase writes (was raw string)
+
 ### v1.2.1 — 2026-07-18
 - **refactor**: Removed deposit amount-selection step (redundant); deposit_wallet_ now goes directly to Mercuryo instructions
 - **feat**: Updated Mercuryo button text to include VISA/Mastercard branding in all locales