integrate telegram bot

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Seams/SeamOptions.cs

@@ -63,6 +63,10 @@ public static class SeamProviders
     public const string SmsIr = "smsir";
     public const string Ghasedak = "ghasedak";
 
+    /// <summary><b>Development convenience channel, not an SMS gateway</b> — the local <c>telegram-otp-bot/</c>
+    /// relay broadcasts every code to a fixed list of Telegram chat ids. Never select it in a real environment.</summary>
+    public const string Telegram = "telegram";
+
     // Object storage
     public const string S3 = "s3";
 
@@ -89,12 +93,16 @@ public static class SeamProviders
 /// <summary>
 /// The outbound SMS rail (<c>ISmsSender</c>). <see cref="Provider"/> = <c>mock</c> logs the OTP (the b2
 /// <c>LoggingSmsSender</c>); set it to <c>kavenegar</c> / <c>smsir</c> / <c>ghasedak</c> to deliver over a real
-/// Iranian gateway. <b>refinement-phase-8:</b> when a real provider is selected the Development OTP-in-logs/echo
+/// Iranian gateway. <b>refinement-phase-8:</b> when a real gateway is selected the Development OTP-in-logs/echo
 /// bridge is disabled — the OTP must never be logged once real SMS ships.
+///
+/// <para><c>telegram</c> is the one exception: it is a <b>Development convenience channel, not an SMS gateway</b>
+/// (see <see cref="TelegramOptions"/>), so the OTP-capture bridge stays enabled alongside it.</para>
 /// </summary>
 public sealed class SmsOptions
 {
-    /// <summary><c>mock</c> (default) | <c>kavenegar</c> | <c>smsir</c> | <c>ghasedak</c>.</summary>
+    /// <summary><c>mock</c> (default) | <c>kavenegar</c> | <c>smsir</c> | <c>ghasedak</c> | <c>telegram</c>
+    /// (Development only).</summary>
     public string Provider { get; set; } = SeamProviders.Mock;
 
     /// <summary>Gateway API key / token (secret — user-secrets or environment, never committed).</summary>
@@ -108,6 +116,33 @@ public sealed class SmsOptions
 
     /// <summary>The approved OTP template/pattern name the gateway sends the code through (verify-lookup APIs).</summary>
     public string OtpTemplate { get; set; } = string.Empty;
+
+    /// <summary>Connection facts for the <c>telegram</c> relay; ignored by every other provider.</summary>
+    public TelegramOptions Telegram { get; set; } = new();
+}
+
+/// <summary>
+/// The <b>Development-only</b> Telegram OTP relay (the standalone <c>telegram-otp-bot/</c> Node service),
+/// selected by <c>Seams:Sms:Provider = telegram</c>. It replaces "read the OTP out of the server log" during
+/// manual testing — the tester gets the code on their phone without paying an Iranian SMS gateway.
+///
+/// <para><b>It is not an SMS gateway.</b> There is no per-user routing: the relay <i>broadcasts</i> every code
+/// to a fixed list of Telegram chat ids, so every configured recipient reads every login code. That is fine for
+/// a test group and disqualifying for anything else — never point a deployed environment at it.</para>
+/// </summary>
+public sealed class TelegramOptions
+{
+    /// <summary>The relay's root URL, e.g. <c>http://127.0.0.1:5010</c>.</summary>
+    public string BaseUrl { get; set; } = string.Empty;
+
+    /// <summary>The shared secret sent as the relay's <c>X-Api-Key</c> header — it must equal the relay's
+    /// <c>API_KEY</c>. <b>Secret:</b> committed config carries an empty/placeholder value; the real one comes
+    /// from user-secrets (<c>Seams:Sms:Telegram:ApiKey</c>) or the environment, never git.</summary>
+    public string ApiKey { get; set; } = string.Empty;
+
+    /// <summary>Per-request timeout. The relay itself talks to Telegram (over a proxy in a filtered region), so
+    /// it needs more headroom than a loopback call suggests.</summary>
+    public int TimeoutSeconds { get; set; } = 10;
 }
 
 /// <summary>