vault: fix koby platform connectivity + document migration lessons

Koby was broken after migration — Zulip credentials lost (only in process memory),
Telegram token overwritten (only existed in old .env.bak-20260603).

Fix: Koby shares Tanko's Zulip bot (tanko-bot@, TANKO_ZULIP_API_KEY in vault).
Telegram token recovered from .env.bak-20260603. Both platforms now connected.

Added Koby migration lessons to contract (back up .env before migration,
inject ALL platform env vars, cat /proc/pid/environ before killing old gateway).
Added KOBY_ZULIP_API_KEY to vault (shares Tanko's key).

litellm-api-keys.prose.md

@@ -119,7 +119,7 @@ runs as user `jerome`, not systemd root, needs user-scope adaptation).
 |-------|------|---------|-----------|--------|
 | abiba | .24 | `infisical run` (pi agent wrapper, service token) | ABIBA_LITELLM_API_KEY | ✅ vault-backed |
 | mumuni | .123 | infisical-gateway.sh + user-login machine identity | MUMUNI_LITELLM_API_KEY | ✅ vault-backed |
-| koby | .129 | infisical-gateway.sh + service token (migrated 2026-07-16) | KOBY_LITELLM_API_KEY | ✅ vault-backed |
+| koby | .129 | infisical-gateway.sh + service token (migrated 2026-07-16) | KOBY_LITELLM_API_KEY | ✅ vault-backed, Zulip (tanko-bot@) + Telegram |
 | koonimo | .114 | infisical-gateway.sh + service token (migrated 2026-07-16) | KOONIMO_LITELLM_API_KEY | ✅ vault-backed |
 | tanko | .122 | **hardcoded in config.yaml** (runs as user jerome, not systemd) | TANKO_LITELLM_API_KEY | ⚠️ TODO: migrate to user-scope wrapper |
 
@@ -131,6 +131,27 @@ Migration: create a user-scope systemd service (`~/.config/systemd/user/hermes-g
 with `infisical-gateway.sh` wrapper in jerome's home, token at `~/.infisical-token`, lingering
 enabled (`loginctl enable-linger jerome`) so the user service runs without a login session.
 
+### Koby migration lessons (2026-07-16)
+
+Migrated Koby from hardcoded systemd drop-in → `infisical-gateway.sh` wrapper.
+**Two mistakes I made that broke the agent:**
+1. **Overwrote `/root/.hermes/.env`** without backing it up. The Zulip API key only existed
+   in the running process memory — the old .env was minimal (just LiteLLM key). Zulip creds were
+   inherited from the pre-migration gateway env, not stored in any file. Lost on restart.
+2. **Only injected `LITELLM_API_KEY`** in the wrapper — forgot Zulip + Telegram credentials.
+   Agents need ALL their platform env vars. Missing vars cause silent adapter failures.
+
+**How Koby actually connects (2026-07-16):**
+- Zulip: shares **Tanko's bot** (`tanko-bot@chat.sysloggh.net`, `TANKO_ZULIP_API_KEY=5PeD6f3zo…`).
+  Koby doesn't have its own Zulip bot (koby-bot@ doesn't exist in the swarm config).
+- Telegram: token `828640…` recovered from `.env.bak-20260603` (18KB backup from June 2026).
+  Allowed users: 6679773481. Home channel: 6679773481.
+- Both platforms now connect through the wrapper's env injection.
+
+**Golden rule for gateway restarts:** always `cat /proc/<pid>/environ` before killing the old
+process — captures the live env set. Especially important when migrating gateways between
+injection mechanisms.
+
 ### Key rotation procedure (one vault operation with this standard)
 
 1. Generate new key: `POST /key/generate` (master key, admin).