fix: address audit findings — nil pointers, timezone bug, dead code, tests, README

- Fix nil pointer dereference in clock.go (guard GetOrCreateSettings and
  GetOrCreateRPGStats errors before accessing fields)
- Fix timezone bug in handleSetBreakMsg (was using system time.Now()
  instead of user's configured timezone)
- Remove dead code: sendExportMonthPicker (unused wrapper)
- Simplify xpForWorkSeconds (xpPerSecond=1, inline to just return sec)
- Extract computeStreakFromDates as pure testable function from
  recalcAggregates; add 6 tests covering empty, current, gaps,
  no-today, long streak, longest-not-current edge cases
- Update README with full feature documentation: RPG, League, Salary,
  Burnout, Work Types, Inline History Editing, all missing commands

internal/bot/settings.go

@@ -146,7 +146,8 @@ func (h *Handler) handleSetBreakMsg(ctx context.Context, msg *models.Message) {
 		h.sendText(ctx, msg.Chat.ID, "Error loading profile")
 		return
 	}
-	now := time.Now()
+	loc := loadLocation(user.Timezone)
+	now := time.Now().In(loc)
 	date := now.Format(DateLayout)
 	day, err := h.DB.GetOrCreateDay(user.ID, date)
 	if err != nil {