add streaming responses, file transfer, remote deploy

- Streaming: use claude --output-format stream-json, edit TG message
  every 5s with progress, show tool use status during execution,
  ◎ cursor indicator while processing
- File transfer: download user uploads to ~/incoming/, scan
  ~/outgoing/{sid}/ for new files after claude completes
- Error handling: wrap post-auth logic in handle_inner, all errors
  reply to user instead of silently failing
- Remote deploy: make deploy-hera via SSH, generate service from
  template with dynamic PATH/REPO
- Service: binary installed to ~/bin/noc, WorkingDirectory=%h
- Invoke claude directly instead of ms wrapper
- Session state persisted to disk across restarts

Makefile

@@ -1,6 +1,8 @@
 REPO := $(shell pwd)
+HERA := heradev
+HERA_DIR := noc
 
-.PHONY: build deploy
+.PHONY: build deploy deploy-hera
 
 build:
 	cargo build --release
@@ -9,8 +11,23 @@ noc.service: noc.service.in
 	sed -e 's|@REPO@|$(REPO)|g' -e 's|@PATH@|$(PATH)|g' $< > $@
 
 deploy: build noc.service
-	mkdir -p ~/.config/systemd/user
+	mkdir -p ~/bin ~/.config/systemd/user
+	systemctl --user stop noc 2>/dev/null || true
+	cp target/release/noc ~/bin/
 	cp noc.service ~/.config/systemd/user/
 	systemctl --user daemon-reload
 	systemctl --user enable --now noc
 	systemctl --user restart noc
+
+deploy-hera: build
+	ssh $(HERA) 'mkdir -p ~/bin ~/$(HERA_DIR) ~/.config/systemd/user && systemctl --user stop noc 2>/dev/null || true'
+	scp target/release/noc $(HERA):~/bin/
+	scp config.hera.yaml noc.service.in $(HERA):~/$(HERA_DIR)/
+	ssh $(HERA) 'bash -lc "\
+		cd ~/$(HERA_DIR) \
+		&& mv -f config.hera.yaml config.yaml \
+		&& sed -e \"s|@REPO@|\$$HOME/$(HERA_DIR)|g\" -e \"s|@PATH@|\$$PATH|g\" noc.service.in > ~/.config/systemd/user/noc.service \
+		&& systemctl --user daemon-reload \
+		&& systemctl --user enable --now noc \
+		&& systemctl --user restart noc \
+		&& systemctl --user status noc"'