feat(dashboard): clarify manual Telegram bot setup

[shannonsands]

What does this PR do?

Makes the two Telegram onboarding paths explicit in the dashboard Channels page:

• Quick setup keeps the managed QR flow as the recommended path.
• Use your own bot opens a guided manual setup flow for bots created with @BotFather.

The manual flow now explains how to create a bot, where to obtain the complete token and numeric user ID, and how leaving the allowlist blank falls back to dashboard pairing approval. It also validates Telegram credentials in both the browser and API so malformed tokens or usernames cannot be silently written as configuration.

This keeps the centralized bot manager convenient without implying it is the only supported setup method.

Related Issue

NS-594: Add wording and clearer options for manual Telegram bot config

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Added clear Quick setup and Use your own bot choices to the Telegram channel card.
• Added BotFather and user-ID instructions, direct links, and DM pairing guidance to the manual form.
• Added client-side validation for Telegram bot-token shape and numeric allowlists.
• Added matching API validation so non-dashboard callers receive the same protection.
• Updated Telegram field metadata and added backend coverage for descriptions and invalid values.

How to Test

1. Open Dashboard → Channels and confirm Telegram offers separate Quick setup and Manual setup controls.
2. Open Manual setup and verify the BotFather, /newbot, user-ID, and Pairing guidance on desktop and mobile widths.
3. Enter an invalid bot token or non-numeric allowed user ID and confirm the form rejects it before saving.
4. Enter a valid-looking token such as 123456789:ABCDEFGHIJKLMNOPQRSTUVWXYZ_1234 and numeric comma-separated user IDs to exercise the accepted API shape in an isolated Hermes home.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS, desktop and mobile browser viewports

Focused validation run:

• pytest -q tests/hermes_cli/test_web_server.py -k 'telegram_onboarding or messaging_platform' (20 passed)
• npm --workspace web run typecheck
• npm --workspace web run build
• npm --workspace web run test -- --run src/lib/api.test.ts
• ruff check hermes_cli/web_server.py hermes_cli/config.py tests/hermes_cli/test_web_server.py
• git diff --check

Documentation & Housekeeping

• I've updated relevant documentation (config.py field metadata supplies the dashboard guidance)
• cli-config.yaml.example update is N/A; no config keys changed
• CONTRIBUTING.md / AGENTS.md update is N/A; no architecture or workflow changed
• I've considered cross-platform impact; the change uses existing dashboard controls and platform-neutral validation
• Tool description/schema updates are N/A

Screenshots / Logs

Manually verified the Telegram choice panel and manual setup dialog at desktop and 390 × 844 mobile viewports. The dialog remains scrollable within the viewport and displays field-level errors for malformed tokens and allowlists.

Infographic