Telegram integration + Herramientas (external connectors) section

[TraX22]

Telegram integration + "Herramientas" (external connectors) section

Drive the HydraOps agents from a phone via a Telegram bot, and add a new
Herramientas section in the sidebar (below Add-ons) for connectors toward
external services (Telegram now; GitHub/Discord/Signal/Reddit shown as
coming-soon). Conceptually: Add-ons = tools the agents call; Herramientas =
connectors that operate on HydraOps from the outside.

How it works

• Send to an agent = POST /api/tasks with channel = <agentId> (deterministic
  routing in the orchestrator). Reply = poll GET /api/tasks/:id until completed
  (no SSE/WebSocket in the stack). Loopback is auth-exempt, so no token needed.

Backend

• New service apps/telegram-bot (mirrors outbox-worker): long-polls the
  Telegram Bot API with native fetch (no telegram library), relays messages to
  agents, polls the task, and sends the reply back. Heartbeats to worker_status;
  hot-reloads config so enabling/disabling and token changes take effect without a
  restart. Registered in KNOWN_SERVICES, the desktop services supervisor
  (phase 2), and the backend bundler.
• Transport-agnostic command layer (telegram-bot/src/commands/): agents,
  use, help, whoami, one-off /<agentId> <msg>, and active-agent fallback —
  decoupled from Telegram so a future global command system can reuse it as a
  shared package. /use <id> <message> switches and sends in one step.
• Access control: allowlist of Telegram user ids + pairing code (/start <code>).
• Secrets: the bot token is stored in the key store via PROVIDER_KEY_NAMES +
  envMapping (telegramBotToken), never DB/.env; masked in GET /config.
  Non-secret config in system_configs.telegram_config. New
  GET/POST /system/integrations/telegram (report tokenConfigured without the value).
• Telegram replies use parse_mode: HTML so fenced code renders as a real code
  frame; POST /tasks accepts isRead so bot tasks show unread activity in the app.

Frontend

• New Herramientas view + route + sidebar entry. Telegram card: enable toggle,
  token field (reuses the key-store save flow), default-agent picker, pairing code,
  allowlist editor; plus coming-soon placeholders. i18n in all 5 locales.
• Chat code blocks: fenced code now renders as a framed dark block with a
  language label, a copy button, and syntax highlighting via prismjs
  (already a dependency). Styles live in the global sheet because the markdown is
  injected via [innerHTML]; Prism is put on the global eagerly in main.ts so
  its language components load under esbuild.
• Scroll-to-bottom button centered.

Verified end-to-end (live)

• Pairing (/start <code>), /agents, /elena …, /use sofia <msg> → real agent
  replies back to Telegram; token stays in the key store (.env/DB show proxy).
• App chat code blocks: frame, One Dark highlighting, and copy button confirmed via
  a headless browser (copy writes the code to the clipboard).

Out of scope (follow-ups): proactive push notifications (bot messages you when a
task/cron completes), attachments/voice, and the other connectors.