Add Telegram webhook support with credential injection

Enable instant message delivery for Telegram via webhooks instead of polling.

Key changes:
- Add tunnel URL configuration for local development (ngrok, cloudflare)
- Auto-register webhook with Telegram API on startup using setWebhook
- Implement webhook secret validation via X-Telegram-Bot-Api-Secret-Token header
- Add credential injection for bot token via URL placeholder substitution
- Fix metadata preservation in respond() to route replies correctly
- Fix serde flatten with Option<T> issue in capabilities schema parsing

The credential injection pattern replaces {TELEGRAM_BOT_TOKEN} placeholders
in URLs with the actual token from the secrets store, keeping credentials
out of WASM module memory until the HTTP request is made.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

src/setup/mod.rs

@@ -18,6 +18,8 @@ mod channels;
 mod prompts;
 mod wizard;
 
-pub use channels::{SecretsContext, setup_http, setup_telegram, validate_telegram_token};
+pub use channels::{
+    SecretsContext, setup_http, setup_telegram, setup_tunnel, validate_telegram_token,
+};
 pub use prompts::{confirm, print_header, print_step, secret_input, select_many, select_one};
 pub use wizard::{SetupConfig, SetupWizard};