test: extend TelegramSessionBatchRendererTests with regression cases

- Empty sessions
- HTML encoding in title
- Confirmed status buttons
- No join link handling

Issue: #33

tests/GmRelay.Bot.Tests/Rendering/SessionBatchViewBuilderTests.cs

@@ -114,7 +114,7 @@ public sealed class SessionBatchViewBuilderTests
     [Fact]
     public void Build_ShouldHandleEmptySessions()
     {
-        var result = SessionBatchViewBuilder.Build("Empty", [], []);
+        var result = SessionBatchViewBuilder.Build("Empty", Array.Empty<SessionBatchDto>(), Array.Empty<ParticipantBatchDto>());
         Assert.Equal("Empty", result.Title);
         Assert.Empty(result.Sessions);
     }
@@ -130,6 +130,10 @@ public sealed class SessionBatchViewBuilderTests
 
         Assert.Equal(SessionStatus.Confirmed, result.Sessions[0].Status);
         Assert.Equal(2, result.Sessions[0].AvailableActions.Count);
+        Assert.Equal("join_session", result.Sessions[0].AvailableActions[0].ActionKey);
+        Assert.Equal("leave_session", result.Sessions[0].AvailableActions[1].ActionKey);
+        Assert.Equal(sessionId, result.Sessions[0].AvailableActions[0].SessionId);
+        Assert.Equal(sessionId, result.Sessions[0].AvailableActions[1].SessionId);
     }
 
     [Fact]
@@ -142,6 +146,7 @@ public sealed class SessionBatchViewBuilderTests
         var result = SessionBatchViewBuilder.Build("Test", sessions, participants);
 
         Assert.Null(result.Sessions[0].MaxPlayers);
-        Assert.Equal(0, result.Sessions[0].ActivePlayerCount);
+        var joinAction = result.Sessions[0].AvailableActions.First(a => a.ActionKey == "join_session");
+        Assert.DoesNotContain("ожидания", joinAction.Label);
     }
 }

tests/GmRelay.Bot.Tests/Rendering/TelegramSessionBatchRendererTests.cs

@@ -77,4 +77,75 @@ public sealed class TelegramSessionBatchRendererTests
 
         Assert.Contains("ожидания", joinButton.Text);
     }
+
+    [Fact]
+    public void Render_ShouldHandleEmptySessions()
+    {
+        var view = SessionBatchViewBuilder.Build("Empty", Array.Empty<SessionBatchDto>(), Array.Empty<ParticipantBatchDto>());
+        var (text, markup) = TelegramSessionBatchRenderer.Render(view);
+
+        Assert.Contains("Empty", text);
+        Assert.DoesNotContain("📅", text);
+        Assert.Empty(markup.InlineKeyboard);
+    }
+
+    [Fact]
+    public void Render_ShouldEncodeHtmlInTitle()
+    {
+        var sessionId = Guid.NewGuid();
+        var sessions = new[] { new SessionBatchDto(sessionId, DateTime.UtcNow, SessionStatus.Planned, 4, "") };
+        var participants = Array.Empty<ParticipantBatchDto>();
+
+        var view = SessionBatchViewBuilder.Build("<script>alert(1)</script>", sessions, participants);
+        var (text, _) = TelegramSessionBatchRenderer.Render(view);
+
+        Assert.Contains("&lt;script&gt;alert(1)&lt;/script&gt;", text);
+        Assert.DoesNotContain("<script>", text);
+    }
+
+    [Fact]
+    public void Render_ShouldShowConfirmedStatusButtons()
+    {
+        var sessionId = Guid.NewGuid();
+        var sessions = new[] { new SessionBatchDto(sessionId, DateTime.UtcNow, SessionStatus.Confirmed, 4, "") };
+        var participants = Array.Empty<ParticipantBatchDto>();
+
+        var view = SessionBatchViewBuilder.Build("Test", sessions, participants);
+        var (_, markup) = TelegramSessionBatchRenderer.Render(view);
+
+        var buttons = markup.InlineKeyboard.SelectMany(row => row).ToList();
+        Assert.Equal(2, buttons.Count);
+        Assert.Contains(buttons, b => b.CallbackData == $"join_session:{sessionId}");
+        Assert.Contains(buttons, b => b.CallbackData == $"leave_session:{sessionId}");
+    }
+
+    [Fact]
+    public void Render_ShouldHandleNoJoinLink()
+    {
+        var sessionId = Guid.NewGuid();
+        var sessions = new[] { new SessionBatchDto(sessionId, DateTime.UtcNow, SessionStatus.Planned, 4, "") };
+        var participants = Array.Empty<ParticipantBatchDto>();
+
+        var view = SessionBatchViewBuilder.Build("Test", sessions, participants);
+        var (text, markup) = TelegramSessionBatchRenderer.Render(view);
+        var buttons = markup.InlineKeyboard.SelectMany(row => row).ToList();
+
+        Assert.DoesNotContain("Ссылка на игру", text);
+        Assert.Contains("📅", text);
+        Assert.Equal(2, buttons.Count);
+    }
+
+    [Fact]
+    public void Render_ShouldEncodeHtmlInJoinLink()
+    {
+        var sessionId = Guid.NewGuid();
+        var sessions = new[] { new SessionBatchDto(sessionId, DateTime.UtcNow, SessionStatus.Planned, 4, "https://example.com/test?a=1&b=2") };
+        var participants = Array.Empty<ParticipantBatchDto>();
+
+        var view = SessionBatchViewBuilder.Build("Test", sessions, participants);
+        var (text, _) = TelegramSessionBatchRenderer.Render(view);
+
+        Assert.Contains("a=1&amp;b=2", text);
+        Assert.DoesNotContain("a=1&b=2" + "\"", text); // make sure & is encoded
+    }
 }