deploy: wire TELEGRAM_SECRET_TOKEN before the fail-closed webhook (#1422) reaches a live-bridge env

[lilyshen0722]

#1422 made Telegram webhook verification fail-closed: a missing TELEGRAM_SECRET_TOKEN now returns 401 unless TELEGRAM_WEBHOOK_ALLOW_UNVERIFIED=true.

Sprint-review verified the prerequisite is not met in our chart: TELEGRAM_SECRET_TOKEN appears nowhere under k8s/ (not in the api-keys ExternalSecret, not in any deployment env block, not in values-*), while TELEGRAM_BOT_TOKEN is wired (k8s/helm/commonly/templates/core/backend-deployment.yaml ← api-keys ← GCP secret). So the bridge is provisioned and a deploy of main as-is 401s every inbound Telegram update.

Before the next deploy to any env with a live bridge:

1. Add telegram-secret-token to the api-keys ExternalSecret and populate the GCP secret.
2. Add TELEGRAM_SECRET_TOKEN to the backend deployment env.
3. Re-register the webhook: setWebhook(url, secret_token=<same value>).
4. Deploy. (Dev/preview envs without a bot can set TELEGRAM_WEBHOOK_ALLOW_UNVERIFIED=true deliberately.)

Also from the same gate, a follow-up for the model: WebhookDelivery keys on {provider, deliveryId} and Telegram update_id is sequential per bot, so a second bot on the route would collide id spaces; widen the key before multi-bot.

🤖 Generated with Claude Code

https://claude.ai/code/session_01X8MxGhdgPini3Q14ay2vXS