P9(5): restore upstream Telegram bot (settings, backup, notifications)

Per user decision 2026-10-21 (reverses the 2026-10-20 drop-Telegram
call): port the upstream 3x-ui v3.7.0-generation Telegram bot wholesale
instead of rewriting a minimal set, adapted to this fork.

- new internal/web/service/tgbot package (telego): bot lifecycle,
  commands, reports, callback router, send helpers; token validation via
  telego; custom API server URL passes the fork's SSRF sanitizer
  (loopback/private bases fall back to the default endpoint, logged)
- settings: full upstream key set (tgBotEnable/Token/Proxy/APIServer/
  ChatId, tgRunTime, tgBotBackup, tgCpu/tgMemory, tgLang,
  tgEnabledEvents) with getters/setters; settings page gains a Telegram
  tab + sidebar entry; token shown masked, clearTgBotToken honored
- wiring (web.go): stats-notify cron registered from tgRunTime when the
  bot is enabled; CheckHashStorage job; CPU/memory alarm jobs gated on
  tgEnabledEvents + thresholds; login notifications via event bus;
  POST /panel/api/setting/testTgBot and /panel/api/backuptotgbot
- lite adaptation: StatsNotifyJob no longer gates on a local Xray core
  (this panel never runs one) so the periodic report and the scheduled
  DB backup (sendDocument) can actually fire
- translations: upstream TG keys restored across all locales

End-to-end smoke (real binary + fake Telegram API over HTTPS at a
public-looking address, browser form wire format): bot starts on
settings change (getMe), testTgBot delivers, panel restart re-arms the
bot, tgRunTime='@every 1m' cron really fires sendDocument carrying the
panel SQLite DB (magic verified) plus the report sendMessage, login
notification delivered, dead-endpoint failure is logged not silent.
13/13 PASS — see P9-REPORT.md.

internal/web/service/setting.go

@@ -112,6 +112,19 @@ var defaultValueMap = map[string]string{
 	// Event bus — per-subscriber event filtering (empty = all disabled)
 
 	// Consecutive failed observatory probes before an outbound.down event fires
+	"tgBotEnable":    "false",
+	"tgBotToken":     "",
+	"tgBotProxy":     "",
+	"tgBotAPIServer": "",
+	"tgBotChatId":    "",
+	"tgRunTime":      "@daily",
+	"tgBotBackup":    "false",
+	"tgCpu":          "80",
+	"tgMemory":       "80",
+	"tgLang":         "en-US",
+	// Event bus — per-subscriber event filtering (empty = all disabled)
+	"tgEnabledEvents": "login.attempt,cpu.high",
+
 	"outboundDownThreshold": "3",
 }
 
@@ -209,6 +222,8 @@ func (s *SettingService) GetAllSettingView() (*entity.AllSettingView, error) {
 		return nil, err
 	}
 	view := &entity.AllSettingView{AllSetting: *allSetting}
+	view.HasTgBotToken = secretConfigured(allSetting.TgBotToken)
+	view.TgBotToken = ""
 	view.HasWarpSecret = secretConfigured(mustString(s.GetWarp()))
 	view.HasNordSecret = secretConfigured(mustString(s.GetNord()))
 	var apiTokenCount int64
@@ -761,6 +776,83 @@ func (s *SettingService) GetAccessLogEnable() (bool, error) {
 // GetOutboundDownThreshold returns how many consecutive failed observatory
 // probes an outbound must accumulate before an outbound.down notification is
 // emitted. 1 preserves the legacy "notify on the first failed probe" behaviour.
+
+func (s *SettingService) GetTgBotToken() (string, error) {
+	return s.getString("tgBotToken")
+}
+
+func (s *SettingService) SetTgBotToken(token string) error {
+	return s.setString("tgBotToken", token)
+}
+
+func (s *SettingService) GetTgBotProxy() (string, error) {
+	return s.getString("tgBotProxy")
+}
+
+func (s *SettingService) SetTgBotProxy(token string) error {
+	return s.setString("tgBotProxy", token)
+}
+
+func (s *SettingService) GetTgBotAPIServer() (string, error) {
+	return s.getString("tgBotAPIServer")
+}
+
+func (s *SettingService) SetTgBotAPIServer(token string) error {
+	return s.setString("tgBotAPIServer", token)
+}
+
+func (s *SettingService) GetTgBotChatId() (string, error) {
+	return s.getString("tgBotChatId")
+}
+
+func (s *SettingService) SetTgBotChatId(chatIds string) error {
+	return s.setString("tgBotChatId", chatIds)
+}
+
+func (s *SettingService) GetTgbotEnabled() (bool, error) {
+	return s.getBool("tgBotEnable")
+}
+
+func (s *SettingService) SetTgbotEnabled(value bool) error {
+	return s.setBool("tgBotEnable", value)
+}
+
+func (s *SettingService) GetTgbotRuntime() (string, error) {
+	return s.getString("tgRunTime")
+}
+
+func (s *SettingService) SetTgbotRuntime(time string) error {
+	return s.setString("tgRunTime", time)
+}
+
+func (s *SettingService) GetTgBotBackup() (bool, error) {
+	return s.getBool("tgBotBackup")
+}
+
+func (s *SettingService) GetTgCpu() (int, error) {
+	return s.getInt("tgCpu")
+}
+
+func (s *SettingService) GetTgMemory() (int, error) {
+	return s.getInt("tgMemory")
+}
+
+func (s *SettingService) SetTgMemory(value int) error {
+	return s.setInt("tgMemory", value)
+}
+
+func (s *SettingService) GetTgLang() (string, error) {
+	return s.getString("tgLang")
+}
+
+func (s *SettingService) GetTgEnabledEvents() (string, error) {
+	return s.getString("tgEnabledEvents")
+}
+
+func (s *SettingService) SetTgEnabledEvents(events string) error {
+	return s.setString("tgEnabledEvents", events)
+}
+
 func (s *SettingService) GetOutboundDownThreshold() (int, error) {
 	return s.getInt("outboundDownThreshold")
 }
@@ -769,7 +861,17 @@ func (s *SettingService) SetOutboundDownThreshold(value int) error {
 	return s.setInt("outboundDownThreshold", value)
 }
 
-func (s *SettingService) UpdateAllSetting(allSetting *entity.AllSetting) error {
+// SecretClears marks redacted secrets the user explicitly emptied. Without a
+// flag, a blank submitted secret means "unchanged" (the field is always served
+// blank to the browser) and the stored value is preserved.
+type SecretClears struct {
+	TgBotToken bool
+}
+
+func (s *SettingService) UpdateAllSetting(allSetting *entity.AllSetting, clears SecretClears) error {
+	if err := s.preserveRedactedSecrets(allSetting, clears); err != nil {
+		return err
+	}
 	if err := validateSettingsURLs(allSetting); err != nil {
 		return err
 	}
@@ -858,7 +960,25 @@ func ValidateRegex(pattern string) error {
 	return nil
 }
 
+func (s *SettingService) preserveRedactedSecrets(allSetting *entity.AllSetting, clears SecretClears) error {
+	if !clears.TgBotToken && strings.TrimSpace(allSetting.TgBotToken) == "" {
+		value, err := s.GetTgBotToken()
+		if err != nil {
+			return err
+		}
+		allSetting.TgBotToken = value
+	}
+	return nil
+}
+
 func validateSettingsURLs(allSetting *entity.AllSetting) error {
+	if allSetting.TgBotAPIServer != "" {
+		u, err := SanitizeHTTPURL(allSetting.TgBotAPIServer)
+		if err != nil {
+			return common.NewError("telegram API server URL is invalid:", err)
+		}
+		allSetting.TgBotAPIServer = u
+	}
 	// Support/profile links land in subscription headers and page data, where
 	// client apps resolve a scheme-less value against the panel's own domain.
 	// Non-http schemes (tg://, mailto:) are legitimate here, so only default