fix(telegram): honor group user allowlists

[itsflownium]

Summary

• Let Telegram group-scoped user allowlists authorize supergroup/forum senders even when a DM-wide allow_from list is configured.
• Keep group_allowed_chats chat-scoped so it does not widen a sender allowlist by itself.
• Accept allowed_users and group_allowed_users config aliases and bridge them to the existing auth variables.

Problem
Telegram intake auth checked config allow_from before the gateway auth resolver. If the owner was in allow_from, an additional supergroup user listed in TELEGRAM_GROUP_ALLOWED_USERS or group_allow_from could be rejected before the group-scoped allowlist was considered. Users also tried allowed_users / group_allowed_users in config.yaml, but those names were not bridged.

Validation

• $HOME/.hermes/hermes-agent/venv/bin/python -m pytest -q tests/gateway/test_telegram_auth_check.py tests/gateway/test_telegram_group_gating.py
• $HOME/.hermes/hermes-agent/venv/bin/python -m ruff check plugins/platforms/telegram/adapter.py gateway/config.py tests/gateway/test_telegram_auth_check.py tests/gateway/test_telegram_group_gating.py
• $HOME/.hermes/hermes-agent/venv/bin/python -m py_compile plugins/platforms/telegram/adapter.py gateway/config.py tests/gateway/test_telegram_auth_check.py tests/gateway/test_telegram_group_gating.py

Refs #55462

[teknium1]

Thanks for isolating the group/forum intake short-circuit. Current main still returns directly from the adapter-level allow_from check at plugins/platforms/telegram/adapter.py:861-865, before the gateway's scoped group-user resolution at gateway/authz_mixin.py:458-566 can run.

Problems

• plugins/platforms/telegram/adapter.py:693 changes explicit empty-list behavior. Current main tests allow_from is not None, so allow_from: [] rejects all senders at intake. The new helper returns an empty set for both a missing key and an explicit empty value, then if adapter_allow_from: treats both as absent. Preserve configured-vs-empty state so the change remains fail-closed.

Suggested changes

• Retain allowlist-key presence separately from normalized values and add regressions for explicit empty allow_from and group-scoped allowlists.

Automated hermes-sweeper review.

[teknium1]

This truthiness check collapses an explicit allow_from: [] into “no configured allowlist.” Before this PR, the is not None check rejected every sender for that explicit empty list. Preserve key presence separately and add a regression so empty lists remain fail-closed.