feat(telegram,discord): migrate bot tokens to plugin userConfig secrets

[dhollman]

Closes H1 #3617646 via the proper path — plugin userConfig with sensitive: true routes tokens to keychain (macOS) or .credentials.json 0600 (elsewhere) instead of world-readable .env files.

**Depends on anthropics/claude-cli-internal#23383 — merged as 8b390a27b0. Ready to merge once a CC release includes it.

Changes per plugin

File	Change
plugin.json	Add userConfig.{PLATFORM}_BOT_TOKEN with sensitive: true, required: true
.mcp.json	Add env: { {PLATFORM}_BOT_TOKEN: "${user_config.{PLATFORM}_BOT_TOKEN}" }
server.ts	Update comment + error message to point to /plugin reconfigure instead of .env

Backward compat

The .env read loop stays as a legacy fallback — process.env wins (injected value takes precedence), so existing users aren't forced to reconfigure. New users get prompted at enable time via CC's built-in dialog; token lands in keychain/secureStorage, never touches settings.json.

/telegram:configure and /discord:configure skills are NOT removed in this PR — they still work for the legacy .env path. Follow-up: repurpose or remove after a grace period once cli#23383 is in a stable release.

How to verify (after cli#23383 ships)

# Install & enable — CC prompts for the token via dialog
/plugin install telegram@claude-plugins-official

# Token is in keychain/credentials.json, NOT settings.json
cat ~/.claude/.credentials.json | jq '.pluginSecrets["telegram@claude-plugins-official"]'
grep TELEGRAM_BOT_TOKEN ~/.claude/settings.json   # should be empty

# Server gets the token via env injection (remove legacy .env to confirm)
rm -f ~/.claude/channels/telegram/.env
# restart CC → server still connects (token from ${user_config.X})

Slack: C0ANJAW8GM6 bug bounty thread