P9(5): restore upstream Telegram bot (settings, backup, notifications)

Per user decision 2026-10-21 (reverses the 2026-10-20 drop-Telegram
call): port the upstream 3x-ui v3.7.0-generation Telegram bot wholesale
instead of rewriting a minimal set, adapted to this fork.

- new internal/web/service/tgbot package (telego): bot lifecycle,
  commands, reports, callback router, send helpers; token validation via
  telego; custom API server URL passes the fork's SSRF sanitizer
  (loopback/private bases fall back to the default endpoint, logged)
- settings: full upstream key set (tgBotEnable/Token/Proxy/APIServer/
  ChatId, tgRunTime, tgBotBackup, tgCpu/tgMemory, tgLang,
  tgEnabledEvents) with getters/setters; settings page gains a Telegram
  tab + sidebar entry; token shown masked, clearTgBotToken honored
- wiring (web.go): stats-notify cron registered from tgRunTime when the
  bot is enabled; CheckHashStorage job; CPU/memory alarm jobs gated on
  tgEnabledEvents + thresholds; login notifications via event bus;
  POST /panel/api/setting/testTgBot and /panel/api/backuptotgbot
- lite adaptation: StatsNotifyJob no longer gates on a local Xray core
  (this panel never runs one) so the periodic report and the scheduled
  DB backup (sendDocument) can actually fire
- translations: upstream TG keys restored across all locales

End-to-end smoke (real binary + fake Telegram API over HTTPS at a
public-looking address, browser form wire format): bot starts on
settings change (getMe), testTgBot delivers, panel restart re-arms the
bot, tgRunTime='@every 1m' cron really fires sendDocument carrying the
panel SQLite DB (magic verified) plus the report sendMessage, login
notification delivered, dead-endpoint failure is logged not silent.
13/13 PASS — see P9-REPORT.md.

internal/web/locale/locale.go

@@ -19,17 +19,24 @@ import (
 var (
 	i18nBundle   *i18n.Bundle
 	LocalizerWeb *i18n.Localizer
+	LocalizerBot *i18n.Localizer
 )
 
 // I18nType represents the type of interface for internationalization.
 type I18nType string
 
 const (
+	Bot I18nType = "bot" // Bot interface type
 	Web I18nType = "web" // Web interface type
 )
 
+// SettingService interface defines methods for accessing locale settings.
+type SettingService interface {
+	GetTgLang() (string, error)
+}
+
 // InitLocalizer initializes the internationalization system with embedded translation files.
-func InitLocalizer(i18nFS embed.FS) error {
+func InitLocalizer(i18nFS embed.FS, settingService SettingService) error {
 	// set default bundle to English
 	i18nBundle = i18n.NewBundle(language.MustParse("en-US"))
 	i18nBundle.RegisterUnmarshalFunc("json", json.Unmarshal)
@@ -39,6 +46,11 @@ func InitLocalizer(i18nFS embed.FS) error {
 		return err
 	}
 
+	// setup bot locale
+	if err := initTGBotLocalizer(settingService); err != nil {
+		return err
+	}
+
 	return nil
 }
 
@@ -59,12 +71,14 @@ func createTemplateData(params []string, separator ...string) map[string]any {
 }
 
 // I18n retrieves a localized message for the given key and type.
-// It supports web contexts, with optional template parameters.
+// It supports both bot and web contexts, with optional template parameters.
 // Returns the localized message or an empty string if localization fails.
 func I18n(i18nType I18nType, key string, params ...string) string {
 	var localizer *i18n.Localizer
 
 	switch i18nType {
+	case "bot":
+		localizer = LocalizerBot
 	case "web":
 		localizer = LocalizerWeb
 	default:
@@ -91,6 +105,17 @@ func I18n(i18nType I18nType, key string, params ...string) string {
 	return msg
 }
 
+// initTGBotLocalizer initializes the bot localizer with the configured language.
+func initTGBotLocalizer(settingService SettingService) error {
+	botLang, err := settingService.GetTgLang()
+	if err != nil {
+		return err
+	}
+
+	LocalizerBot = i18n.NewLocalizer(i18nBundle, botLang)
+	return nil
+}
+
 // LocalizerMiddleware returns a Gin middleware that sets up localization for web requests.
 // It determines the user's language from cookies or Accept-Language header,
 // creates a localizer instance, and stores it in the Gin context for use in handlers.