Telegram: Bot API ingress channel (closes #39)

[lezama]

Closes #39

Summary

Adds Telegram as a second inbound channel alongside WhatsApp. v1 is text-only; mirrors the WhatsApp module almost line-for-line so the multi-channel architecture stays consistent.

• New OpenclaWP_Telegram class: REST webhook + outbound sendMessage + admin page at openclaWP → Telegram, plus a card on the Channels list.
• Authentication via X-Telegram-Bot-Api-Secret-Token (constant-time compare, fails closed when secret or header is empty).
• Per-chat CSV allowlist (literal * opens it up for dev). Drop counter surfaced on the admin page as a notice.
• Default-agent picker + owner-user-ID, identical to WhatsApp.
• Off by default — gated by openclawp_register_telegram filter.
• "Register webhook" button calls Telegram's setWebhook with our URL + secret_token.
• Replies thread via reply_to_message_id when an inbound message_id is present.
• No new HTTP client deps — wp_remote_post only.

Test plan

• vendor/bin/phpunit --testsuite unit — 46 tests, 70 assertions (16 new in TelegramWebhookTest)
• npm run lint — clean
• php -l on every changed file — no syntax errors
• php tests/smoke.php inside Studio — exercises the webhook handler end-to-end for the three required scenarios (HMAC mismatch → 401, allowlisted chat → 200+processed, unauthorized chat → 200+dropped)
• End-to-end via BotFather following docs/telegram-setup.md

What deferred (per issue v1 scope)

• Media (photos, voice, stickers, documents) — ack 200 + log telegram_unsupported_type.
• Inline mode, callback queries, polls.
• Multi-bot routing.

Quality gate results

Gate	Result
PHP lint (php -l)	pass
vendor/bin/phpunit --testsuite unit	pass (46/46)
npm run lint	pass
Browser test	n/a — backend + server-rendered admin only