feat(plugin/telegram_bot): replace bare prompts with 5-step guided setup wizard

Step 1 — create bot via @BotFather (instructions + press-any-key pause)
Step 2 — find Telegram user ID via @userinfobot (instructions + pause)
Step 3 — set session passphrase with security explanation
Step 4 — save all three vault keys, print ✓ confirmations
Step 5 — configuration complete marker

Adds setup cancellation on empty token, updated tests: happy path, mismatch,
and cancel all covered; press_any_key_to_continue calls properly patched.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/unit/test_telegram_bot.py

@@ -166,19 +166,64 @@ class TestPluginLifecycle:
         fields = plugin.config_fields()
         assert any(f.key == "rate_limit" for f in fields)
 
-    def test_setup_mismatched_passphrase(self, capsys):
-        """setup() exits cleanly when passphrases don't match."""
+    def _patch_setup(self, token, allowed, pass1, pass2):
+        """Return a context manager that patches all questionary calls used by setup()."""
+        pw_answers = iter([token, pass1, pass2])
+        return (
+            patch("questionary.password",
+                  side_effect=lambda *a, **kw: MagicMock(ask=lambda: next(pw_answers))),
+            patch("questionary.text",
+                  return_value=MagicMock(ask=lambda: allowed)),
+            patch("questionary.press_any_key_to_continue",
+                  return_value=MagicMock(ask=lambda: None)),
+        )
+
+    def test_setup_mismatched_passphrase(self):
+        """setup() writes nothing to the vault when passphrases don't match."""
         plugin = TelegramBotPlugin()
         console = MagicMock()
         vault_writer = MagicMock()
 
-        answers = iter(["fake-token", "user123", "pass1", "pass2"])
-        with patch("questionary.password", side_effect=lambda *a, **kw: MagicMock(ask=lambda: next(answers))), \
-             patch("questionary.text", return_value=MagicMock(ask=lambda: next(answers))):
+        pw_patch, text_patch, pakc_patch = self._patch_setup(
+            "fake-token", "123456789", "pass1", "pass2"
+        )
+        with pw_patch, text_patch, pakc_patch:
+            plugin.setup(console, vault_writer)
+
+        vault_writer.assert_not_called()
+        console.print.assert_called_with(
+            "[red]Passphrases do not match. Run setup again to retry.[/red]"
+        )
+
+    def test_setup_happy_path(self):
+        """setup() writes all three vault keys when credentials are valid."""
+        plugin = TelegramBotPlugin()
+        console = MagicMock()
+        vault_writer = MagicMock()
+
+        pw_patch, text_patch, pakc_patch = self._patch_setup(
+            "real-token", "111222333", "s3cr3t", "s3cr3t"
+        )
+        with pw_patch, text_patch, pakc_patch:
+            plugin.setup(console, vault_writer)
+
+        calls = {call[0][0]: call[0][1] for call in vault_writer.call_args_list}
+        assert calls.get("plugin:telegram_bot:token") == "real-token"
+        assert calls.get("plugin:telegram_bot:allowed_users") == "111222333"
+        assert "plugin:telegram_bot:passphrase_hash" in calls
+
+    def test_setup_cancelled_on_empty_token(self):
+        """setup() exits without writing if the token prompt is cancelled."""
+        plugin = TelegramBotPlugin()
+        console = MagicMock()
+        vault_writer = MagicMock()
+
+        with patch("questionary.password", return_value=MagicMock(ask=lambda: None)), \
+             patch("questionary.press_any_key_to_continue",
+                   return_value=MagicMock(ask=lambda: None)):
             plugin.setup(console, vault_writer)
 
         vault_writer.assert_not_called()
-        console.print.assert_called_with("[red]Passphrases do not match.[/red]")
 
 
 # ── Auth session state ────────────────────────────────────────────────────────