P9(5): restore upstream Telegram bot (settings, backup, notifications)

Per user decision 2026-10-21 (reverses the 2026-10-20 drop-Telegram
call): port the upstream 3x-ui v3.7.0-generation Telegram bot wholesale
instead of rewriting a minimal set, adapted to this fork.

- new internal/web/service/tgbot package (telego): bot lifecycle,
  commands, reports, callback router, send helpers; token validation via
  telego; custom API server URL passes the fork's SSRF sanitizer
  (loopback/private bases fall back to the default endpoint, logged)
- settings: full upstream key set (tgBotEnable/Token/Proxy/APIServer/
  ChatId, tgRunTime, tgBotBackup, tgCpu/tgMemory, tgLang,
  tgEnabledEvents) with getters/setters; settings page gains a Telegram
  tab + sidebar entry; token shown masked, clearTgBotToken honored
- wiring (web.go): stats-notify cron registered from tgRunTime when the
  bot is enabled; CheckHashStorage job; CPU/memory alarm jobs gated on
  tgEnabledEvents + thresholds; login notifications via event bus;
  POST /panel/api/setting/testTgBot and /panel/api/backuptotgbot
- lite adaptation: StatsNotifyJob no longer gates on a local Xray core
  (this panel never runs one) so the periodic report and the scheduled
  DB backup (sendDocument) can actually fire
- translations: upstream TG keys restored across all locales

End-to-end smoke (real binary + fake Telegram API over HTTPS at a
public-looking address, browser form wire format): bot starts on
settings change (getMe), testTgBot delivers, panel restart re-arms the
bot, tgRunTime='@every 1m' cron really fires sendDocument carrying the
panel SQLite DB (magic verified) plus the report sendMessage, login
notification delivered, dead-endpoint failure is logged not silent.
13/13 PASS — see P9-REPORT.md.

internal/web/service/setting_clash_test.go

@@ -79,7 +79,7 @@ func TestUpdateAllSettingPreservesEmptyUserAgentRegexes(t *testing.T) {
 	settings.SubJsonUserAgentRegex = "   "
 	settings.SubClashUserAgentRegex = ""
 
-	if err := s.UpdateAllSetting(settings); err != nil {
+	if err := s.UpdateAllSetting(settings, SecretClears{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -129,7 +129,7 @@ func TestUpdateAllSettingPersistsClashSubscriptionSettings(t *testing.T) {
 	settings.SubClashPath = "/clash-custom/"
 	settings.SubClashURI = "https://subscriptions.example.com/clash-custom/"
 
-	if err := s.UpdateAllSetting(settings); err != nil {
+	if err := s.UpdateAllSetting(settings, SecretClears{}); err != nil {
 		t.Fatal(err)
 	}
 
@@ -180,7 +180,7 @@ func TestUpdateAllSettingRejectsInvalidClashUserAgentRegex(t *testing.T) {
 		t.Fatal(err)
 	}
 	settings.SubClashUserAgentRegex = "["
-	if err := s.UpdateAllSetting(settings); err == nil {
+	if err := s.UpdateAllSetting(settings, SecretClears{}); err == nil {
 		t.Fatal("UpdateAllSetting accepted an invalid Clash/Mihomo User-Agent regex")
 	}
 }
@@ -193,7 +193,7 @@ func TestUpdateAllSettingRejectsInvalidJsonUserAgentRegex(t *testing.T) {
 		t.Fatal(err)
 	}
 	settings.SubJsonUserAgentRegex = "["
-	if err := s.UpdateAllSetting(settings); err == nil {
+	if err := s.UpdateAllSetting(settings, SecretClears{}); err == nil {
 		t.Fatal("UpdateAllSetting accepted an invalid Xray JSON User-Agent regex")
 	}
 }