P9(5): restore upstream Telegram bot (settings, backup, notifications)

Per user decision 2026-10-21 (reverses the 2026-10-20 drop-Telegram
call): port the upstream 3x-ui v3.7.0-generation Telegram bot wholesale
instead of rewriting a minimal set, adapted to this fork.

- new internal/web/service/tgbot package (telego): bot lifecycle,
  commands, reports, callback router, send helpers; token validation via
  telego; custom API server URL passes the fork's SSRF sanitizer
  (loopback/private bases fall back to the default endpoint, logged)
- settings: full upstream key set (tgBotEnable/Token/Proxy/APIServer/
  ChatId, tgRunTime, tgBotBackup, tgCpu/tgMemory, tgLang,
  tgEnabledEvents) with getters/setters; settings page gains a Telegram
  tab + sidebar entry; token shown masked, clearTgBotToken honored
- wiring (web.go): stats-notify cron registered from tgRunTime when the
  bot is enabled; CheckHashStorage job; CPU/memory alarm jobs gated on
  tgEnabledEvents + thresholds; login notifications via event bus;
  POST /panel/api/setting/testTgBot and /panel/api/backuptotgbot
- lite adaptation: StatsNotifyJob no longer gates on a local Xray core
  (this panel never runs one) so the periodic report and the scheduled
  DB backup (sendDocument) can actually fire
- translations: upstream TG keys restored across all locales

End-to-end smoke (real binary + fake Telegram API over HTTPS at a
public-looking address, browser form wire format): bot starts on
settings change (getMe), testTgBot delivers, panel restart re-arms the
bot, tgRunTime='@every 1m' cron really fires sendDocument carrying the
panel SQLite DB (magic verified) plus the report sendMessage, login
notification delivered, dead-endpoint failure is logged not silent.
13/13 PASS — see P9-REPORT.md.

internal/web/service/tgbot/tgbot_send_test.go

@@ -0,0 +1,35 @@
+package tgbot
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestPageMessageSplitsLinkListWithoutBlankLines(t *testing.T) {
+	var message strings.Builder
+	message.WriteString("Individual links:\r\n")
+	for range 50 {
+		message.WriteString("<code>vless://" + strings.Repeat("a", 300) + "</code>\r\n")
+	}
+
+	pages := pageMessage(message.String(), telegramPageLimit)
+	if len(pages) < 2 {
+		t.Fatalf("pageMessage() returned %d page, want multiple", len(pages))
+	}
+
+	links := 0
+	for index, page := range pages {
+		if len(page) > telegramPageLimit {
+			t.Errorf("page %d has %d bytes, want at most %d", index, len(page), telegramPageLimit)
+		}
+		openingTags := strings.Count(page, "<code>")
+		closingTags := strings.Count(page, "</code>")
+		if openingTags != closingTags {
+			t.Errorf("page %d has %d opening tags and %d closing tags", index, openingTags, closingTags)
+		}
+		links += openingTags
+	}
+	if links != 50 {
+		t.Errorf("pages contain %d links, want 50", links)
+	}
+}