feat(social-publishing): add Telegram channel publishing adapter #646

Depends on: #631, #632, #636, #643

Context

Telegram supports channel posting through bots when the bot has the required channel permissions. News portal deployments can use this as an optional social publishing provider for automatic posting to an official Telegram channel.

This is full-online only and must be optional per tenant.

Objective

Add a Telegram channel publishing adapter for posting eligible published news articles to configured Telegram channels through the provider-neutral social publishing outbox.

Scope

Provider key:

telegram_channel

Supported initial actions:

publish_news_link_to_telegram_channel
verify_telegram_bot_and_channel

Configuration should support:

TELEGRAM_PROVIDER_ENABLED
TELEGRAM_BOT_TOKEN_SECRET_REFERENCE
TELEGRAM_DEFAULT_PARSE_MODE
TELEGRAM_REQUEST_TIMEOUT_MS

Account/channel metadata:

channel_id_or_username
channel_title
bot_username
permissions_json
last_verified_at

Post template data:

• News title.
• Excerpt/summary.
• Canonical /news/... URL.
• Optional hashtags from tags.
• Optional R2 image preview if later supported through sendPhoto; initial scope can use safe link post through sendMessage.

Required behavior

• Publish only public/published articles.
• Never post draft, private, review, archived, or soft-deleted content.
• Verify bot/channel access before enabling rule.
• Use outbox jobs from feat(social-publishing): add secure social auto-posting outbox and connector foundation #643.
• Use idempotency to prevent duplicate posting.
• Store Telegram message ID where available.
• Normalize provider errors into safe internal statuses.
• Handle missing permission as failed or needs_reconfiguration.

Out of scope

• Telegram group moderation.
• Comment sync.
• Inline bot features.
• Scraping Telegram.
• WhatsApp auto posting.

Acceptance criteria

• Tenant admin can configure a Telegram channel publishing account.
• Bot token is stored only as a secret reference.
• Readiness check verifies provider enabled, bot token reference, and channel identifier.
• Adapter verifies bot can post to the target channel before enabling auto posting.
• Publishing job sends a safe message containing title, excerpt, and canonical URL.
• Markdown/HTML parse mode is sanitized or disabled by default to avoid formatting injection.
• Provider response message ID is stored where available.
• Retry/backoff does not duplicate already-published posts due to idempotency.
• Audit log records configure, verify, publish attempt, success, failure, retry, and disable events.
• OpenAPI/AsyncAPI are updated.
• Docs note required Telegram bot/channel permissions.
• Tests cover missing token, invalid channel, permission failure, successful publish mock, parse-mode sanitization, idempotency, and secret redaction.
• bun run api:spec:check passes.
• bun run test passes.
• bun run build passes.
• bun run check passes.

Security notes

• Never expose bot token to browser JavaScript.
• Do not log full Telegram request URLs because bot tokens may appear in URLs if implemented incorrectly.
• Prefer POST request bodies and safe HTTP client logging redaction.
• Sanitize Markdown/HTML parse mode or default to plain text.