feat(channels): Slack bot + Telegram allowlist & group @-mention gating

[KillerQueen-Z]

What

• Slack: restore the slack command + channel (was uncommitted WIP, nearly lost) and register it in the CLI.
• Telegram: add TELEGRAM_ALLOWED_USERS allowlist (owner always allowed); in groups only act on @mention or reply-to-bot (mention stripped before the prompt), ignore other group chatter; private chats unchanged.

Notes

• Stacked on feat/webui-server (so the diff is just the channels commit). After that merges, this retargets to main.

[VickyXAI]

Code review

Found 3 issues:

1. franklin slack crashes at runtime for every npm-installed user: src/channel/slack.ts does await import('@slack/bolt'), but @slack/bolt is not declared in package.json (this PR doesn't touch it). Dynamic import means the build passes, then the command dies with Cannot find package '@slack/bolt' on first run. Add it to dependencies (or catch the import failure with an actionable "npm install @slack/bolt" message if it's meant to be optional).

Franklin/src/channel/slack.ts

Lines 125 to 129 in 1e7f236

	// Lazy import keeps @slack/bolt out of the load path for users who never
	// run the Slack bot, matching how heavy optional deps are handled elsewhere.
	const { App, LogLevel } = await import('@slack/bolt');

2. The Slack capability_start handler posts a separate ⏳ ${event.name}… message for every tool call — the exact flooding pattern commit 7e527e8 ("one 'Working…' ping per turn instead of one per tool call — a multi-tool run otherwise floods the chat") removed from Telegram, and which this same PR upgrades further on the Telegram side to a single per-turn toolsUsed summary. A 10-tool agent turn posts 10 spinner messages into the thread. Apply the same accumulate-and-summarize pattern here.

Franklin/src/channel/slack.ts

Lines 273 to 284 in 1e7f236

	break;
	case 'capability_start':
	if (state.currentTarget) {
	if (state.responseBuffer.trim()) {
	const target = state.currentTarget;
	const text = state.responseBuffer.trim();
	state.responseBuffer = '';
	void postMessage(target, text);
	}
	void postMessage(state.currentTarget, `⏳ ${event.name}…`);
	}
	break;

3. Two Chinese user-facing strings in src/channel/telegram.ts — the /tools toggle reply and the per-turn tool summary (repo rule: src/ is English-only; every other user-facing string in this file is English). Suggested: Tool summary: on/off and Used N tools: ….

Franklin/src/channel/telegram.ts

Lines 200 to 202 in 1e7f236

	savePrefs({ showTools: state.showTools });
	await sendMessage(chatId, `🔧 工具调用汇总:${state.showTools ? '开启 ✅' : '关闭'}`);
	return true;

Franklin/src/channel/telegram.ts

Lines 324 to 326 in 1e7f236

	const uniq = [...new Set(state.toolsUsed)];
	void sendMessage(chatId, `🔧 用了 ${state.toolsUsed.length} 个工具:${uniq.join(' · ')}`);
	}

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}