P9(5): restore upstream Telegram bot (settings, backup, notifications)

Per user decision 2026-10-21 (reverses the 2026-10-20 drop-Telegram
call): port the upstream 3x-ui v3.7.0-generation Telegram bot wholesale
instead of rewriting a minimal set, adapted to this fork.

- new internal/web/service/tgbot package (telego): bot lifecycle,
  commands, reports, callback router, send helpers; token validation via
  telego; custom API server URL passes the fork's SSRF sanitizer
  (loopback/private bases fall back to the default endpoint, logged)
- settings: full upstream key set (tgBotEnable/Token/Proxy/APIServer/
  ChatId, tgRunTime, tgBotBackup, tgCpu/tgMemory, tgLang,
  tgEnabledEvents) with getters/setters; settings page gains a Telegram
  tab + sidebar entry; token shown masked, clearTgBotToken honored
- wiring (web.go): stats-notify cron registered from tgRunTime when the
  bot is enabled; CheckHashStorage job; CPU/memory alarm jobs gated on
  tgEnabledEvents + thresholds; login notifications via event bus;
  POST /panel/api/setting/testTgBot and /panel/api/backuptotgbot
- lite adaptation: StatsNotifyJob no longer gates on a local Xray core
  (this panel never runs one) so the periodic report and the scheduled
  DB backup (sendDocument) can actually fire
- translations: upstream TG keys restored across all locales

End-to-end smoke (real binary + fake Telegram API over HTTPS at a
public-looking address, browser form wire format): bot starts on
settings change (getMe), testTgBot delivers, panel restart re-arms the
bot, tgRunTime='@every 1m' cron really fires sendDocument carrying the
panel SQLite DB (magic verified) plus the report sendMessage, login
notification delivered, dead-endpoint failure is logged not silent.
13/13 PASS — see P9-REPORT.md.

frontend/src/generated/schemas.ts

@@ -134,6 +134,43 @@ export const SCHEMAS: Record<string, unknown> = {
         "minimum": 0,
         "type": "integer"
       },
+      "tgBotAPIServer": {
+        "type": "string"
+      },
+      "tgBotBackup": {
+        "type": "boolean"
+      },
+      "tgBotChatId": {
+        "type": "string"
+      },
+      "tgBotEnable": {
+        "type": "boolean"
+      },
+      "tgBotProxy": {
+        "type": "string"
+      },
+      "tgBotToken": {
+        "type": "string"
+      },
+      "tgCpu": {
+        "maximum": 100,
+        "minimum": 0,
+        "type": "integer"
+      },
+      "tgEnabledEvents": {
+        "type": "string"
+      },
+      "tgLang": {
+        "type": "string"
+      },
+      "tgMemory": {
+        "maximum": 100,
+        "minimum": 0,
+        "type": "integer"
+      },
+      "tgRunTime": {
+        "type": "string"
+      },
       "timeLocation": {
         "type": "string"
       },
@@ -211,6 +248,17 @@ export const SCHEMAS: Record<string, unknown> = {
       "subTitle",
       "subURI",
       "subUpdates",
+      "tgBotAPIServer",
+      "tgBotBackup",
+      "tgBotChatId",
+      "tgBotEnable",
+      "tgBotProxy",
+      "tgBotToken",
+      "tgCpu",
+      "tgEnabledEvents",
+      "tgLang",
+      "tgMemory",
+      "tgRunTime",
       "timeLocation",
       "trafficDiff",
       "trustedProxyCIDRs",
@@ -239,6 +287,9 @@ export const SCHEMAS: Record<string, unknown> = {
       "hasNordSecret": {
         "type": "boolean"
       },
+      "hasTgBotToken": {
+        "type": "boolean"
+      },
       "hasWarpSecret": {
         "type": "boolean"
       },
@@ -367,6 +418,43 @@ export const SCHEMAS: Record<string, unknown> = {
         "minimum": 0,
         "type": "integer"
       },
+      "tgBotAPIServer": {
+        "type": "string"
+      },
+      "tgBotBackup": {
+        "type": "boolean"
+      },
+      "tgBotChatId": {
+        "type": "string"
+      },
+      "tgBotEnable": {
+        "type": "boolean"
+      },
+      "tgBotProxy": {
+        "type": "string"
+      },
+      "tgBotToken": {
+        "type": "string"
+      },
+      "tgCpu": {
+        "maximum": 100,
+        "minimum": 0,
+        "type": "integer"
+      },
+      "tgEnabledEvents": {
+        "type": "string"
+      },
+      "tgLang": {
+        "type": "string"
+      },
+      "tgMemory": {
+        "maximum": 100,
+        "minimum": 0,
+        "type": "integer"
+      },
+      "tgRunTime": {
+        "type": "string"
+      },
       "timeLocation": {
         "type": "string"
       },
@@ -408,6 +496,7 @@ export const SCHEMAS: Record<string, unknown> = {
       "expireDiff",
       "hasApiToken",
       "hasNordSecret",
+      "hasTgBotToken",
       "hasWarpSecret",
       "ipLimitAllowlist",
       "outboundDownThreshold",
@@ -447,6 +536,17 @@ export const SCHEMAS: Record<string, unknown> = {
       "subTitle",
       "subURI",
       "subUpdates",
+      "tgBotAPIServer",
+      "tgBotBackup",
+      "tgBotChatId",
+      "tgBotEnable",
+      "tgBotProxy",
+      "tgBotToken",
+      "tgCpu",
+      "tgEnabledEvents",
+      "tgLang",
+      "tgMemory",
+      "tgRunTime",
       "timeLocation",
       "trafficDiff",
       "trustedProxyCIDRs",