feat: verify telegram owner during hot activation (#1157)

* feat(telegram): verify owner during hot activation

* fix(ci): satisfy no-panics and clippy checks

* fix(web): preserve relay activation status

* fix(telegram): redact setup errors

* fix(telegram): require owner verification code

* fix(telegram): allow code in conversational dm

src/extensions/mod.rs

@@ -453,6 +453,17 @@ pub struct ActivateResult {
 ///
 /// Returned by `ExtensionManager::configure()`, the single entrypoint
 /// for providing secrets to any extension (chat auth, gateway setup, etc.).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct VerificationChallenge {
+    /// One-time code the user must send back to the integration.
+    pub code: String,
+    /// Human-readable instructions for completing verification.
+    pub instructions: String,
+    /// Deep-link or shortcut URL that prefills the verification payload when supported.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deep_link: Option<String>,
+}
+
 #[derive(Debug, Clone)]
 pub struct ConfigureResult {
     /// Human-readable status message.
@@ -461,6 +472,8 @@ pub struct ConfigureResult {
     pub activated: bool,
     /// OAuth authorization URL (if OAuth flow was started).
     pub auth_url: Option<String>,
+    /// Pending manual verification challenge (for Telegram owner binding, etc.).
+    pub verification: Option<VerificationChallenge>,
 }
 
 fn default_true() -> bool {