DM pairing + Telegram channel improvements (#17)

* feat: Implement DM pairing for channels

- Introduced a new pairing system to manage direct messages from unknown senders.
- Added `PairingStore` to handle pending requests and allowlist management.
- Implemented CLI commands for listing and approving pairing requests.
- Updated Telegram channel to utilize the new pairing logic, including workspace paths for storing pairing data.
- Enhanced WASM channel integration to support pairing functionality.

This feature enhances security by requiring approval for unknown senders before they can interact with the agent.

* Enhance Telegram channel support with media captioning and DM pairing features

- Added support for media captions in Telegram messages, allowing for richer content handling.
- Updated message processing to utilize either text or caption, improving message flexibility.
- Enhanced DM pairing functionality to include approval and listing capabilities for direct messages.
- Updated feature parity documentation to reflect new capabilities and improvements in Telegram integration.

* Update README and BUILDING_CHANNELS documentation for Telegram channel integration

- Enhanced README with instructions for building and running the Telegram channel, including a note on running `./scripts/build-all.sh` for full releases.
- Added detailed steps in BUILDING_CHANNELS.md for building and deploying the Telegram channel, emphasizing the need to run `./channels-src/telegram/build.sh` before building the main crate to ensure updated WASM is included.
- Updated CLI module to expose a new command for pairing with store functionality.

* Implement build script for Telegram channel WASM and enhance pairing error handling

- Added a new `build.rs` script to automate the compilation of the Telegram channel's WASM binary from source, ensuring reproducible builds and emphasizing supply chain security by preventing committed binaries.
- Updated `BUILDING_CHANNELS.md` to reflect the new build process and the importance of not committing compiled binaries.
- Enhanced error handling in the pairing approval process to include rate limiting for failed attempts, improving security and user feedback.

* Remove Telegram channel WASM binary file as part of the build process cleanup, ensuring no committed binaries are present in the repository.

wit/channel.wit

@@ -147,6 +147,32 @@ interface channel-host {
     /// - Path validation fails (traversal attempt, absolute path)
     /// - Write operation fails
     workspace-write: func(path: string, content: string) -> result<_, string>;
+
+    // ==================== DM Pairing ====================
+
+    /// Result of upserting a pairing request.
+    record pairing-upsert-result {
+        code: string,
+        created: bool,
+    }
+
+    /// Upsert a pairing request for an unknown sender.
+    /// Returns (code, created). When created is true, the channel should send a pairing reply.
+    pairing-upsert-request: func(
+        channel: string,
+        id: string,
+        meta-json: string
+    ) -> result<pairing-upsert-result, string>;
+
+    /// Check if a sender is allowed (in allowFrom store).
+    pairing-is-allowed: func(
+        channel: string,
+        id: string,
+        username: option<string>
+    ) -> result<bool, string>;
+
+    /// Read the allowFrom list (for merging with config allowFrom).
+    pairing-read-allow-from: func(channel: string) -> result<list<string>, string>;
 }
 
 /// Channel interface that sandboxed channels must implement.