Add Telegram webhook support with credential injection

Enable instant message delivery for Telegram via webhooks instead of polling.

Key changes:
- Add tunnel URL configuration for local development (ngrok, cloudflare)
- Auto-register webhook with Telegram API on startup using setWebhook
- Implement webhook secret validation via X-Telegram-Bot-Api-Secret-Token header
- Add credential injection for bot token via URL placeholder substitution
- Fix metadata preservation in respond() to route replies correctly
- Fix serde flatten with Option<T> issue in capabilities schema parsing

The credential injection pattern replaces {TELEGRAM_BOT_TOKEN} placeholders
in URLs with the actual token from the secrets store, keeping credentials
out of WASM module memory until the HTTP request is made.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

src/tools/wasm/limits.rs

@@ -79,13 +79,16 @@ pub struct WasmResourceLimiter {
 
 impl WasmResourceLimiter {
     /// Create a new limiter with the given memory limit.
+    ///
+    /// Note: max_instances is set to 10 to accommodate WASM Component Model
+    /// which creates multiple internal instances (main component + WASI adapters).
     pub fn new(memory_limit: u64) -> Self {
         Self {
             memory_limit,
             memory_used: 0,
             max_tables: 10,
             tables_created: 0,
-            max_instances: 1,
+            max_instances: 10, // Component model needs multiple instances for WASI
             instances_created: 0,
         }
     }
@@ -157,7 +160,7 @@ impl ResourceLimiter for WasmResourceLimiter {
     }
 
     fn memories(&self) -> usize {
-        // Allow one memory per instance
+        // Allow multiple memories for component model with WASI
         self.max_instances as usize
     }
 }