feat(gateway): add Telegram gateway support

[joaopedroab]

Linked issue

N/A - feature branch sync and gateway expansion.

Summary

• Adds Telegram as a first-class message gateway connector with inbound DMs, explicit user linking, outbound replies, polling controls, and attachment intake.
• Extends gateway channel persistence, MCP tools, and user external identity support so Telegram channels can be configured and operated consistently with existing gateway providers.
• Adds Settings UI fields and documentation for Telegram setup, polling, transport disabling, and operational safeguards.

Why / context

The gateway already supports routing external conversations into Agor sessions, but Telegram needed provider-specific normalization, authentication/linking, durable polling behavior, and UI/admin surfaces before it could be used reliably. This PR adds those boundaries while preserving the existing Slack/GitHub gateway behavior.

Implementation notes

• Adds TelegramConnector plus normalization/auth helpers in packages/core/src/gateway/connectors/telegram.ts, including explicit link intent parsing, private thread IDs, outbound formatting, and attachment metadata handling.
• Extends gateway service handling for Telegram polling state so updates are reserved, side effects are tracked, and acknowledgements are durable across replay/retry cases.
• Adds external identity repository support and MCP user tools for listing/removing linked provider identities.
• Adds gateway channel configuration support for Telegram bot token, polling interval, transport disabling, and UI redacted-token editing.
• Adds upload filename hardening and normalized inbound attachment metadata so Telegram media can be stored without exposing provider-private file URLs or tokens to prompts.

Validation / test plan

• pnpm --filter @agor/core typecheck - passed after fixing the Telegram gateway type errors.
• pnpm --filter @agor/core test -- src/gateway/connectors/telegram.test.ts src/db/repositories/gateway-channels.test.ts src/db/repositories/users.test.ts - 3 files passed, 95 tests passed.
• pnpm --filter @agor/daemon test -- src/services/gateway.test.ts src/mcp/tools/gateway-channels.test.ts src/mcp/tools/users.test.ts - 3 files passed, 154 tests passed.
• pnpm --filter agor-ui test -- src/components/SettingsModal/GatewayChannelsTable.test.tsx - 1 file passed, 18 tests passed.
• pnpm --filter @agor/core test -- src/db/repositories/users.test.ts src/gateway/connectors/telegram.test.ts - 2 files passed, 77 tests passed after the typecheck fix.
• Commit hooks ran during the merge commit and completed biome ci plus prettier --write for the staged files.

Screenshots / demos

N/A - no screenshot captured for this draft PR.

Risks / rollout / rollback

Risk is concentrated in gateway provider behavior, polling idempotency, and user identity linking. Telegram channels are opt-in behind explicit channel configuration, so rollback is to disable/delete the Telegram channel or revert the PR if the new provider path causes regressions.

Out of scope / follow-ups

• Production Telegram bot provisioning and secrets are deployment configuration, not included in this PR.
• End-to-end validation with a live Telegram bot is not included in this local test pass.