feat: add Telegram and WhatsApp to OpenClaw setup picker

[louisgv]

Summary

Add Telegram and WhatsApp as setup options in the OpenClaw interactive setup screen.

Background

This feature was originally developed in PR #2523, which was closed due to merge conflicts and divergence from main. The core feature needs to be reimplemented in a fresh PR based on current main.

Requirements

Telegram Setup

• Add checkbox option: "Telegram (connect via bot token from @Botfather)"
• Prompt user for bot token
• Inject token via openclaw config (securely, without command injection)
• Support env var override: SPAWN_TELEGRAM_BOT_TOKEN

WhatsApp Setup

• Add checkbox option: "WhatsApp (scan QR code via web dashboard after launch)"
• Display reminder about web dashboard QR scanning
• Support interactive QR scan before TUI launch

Setup Screen Example

◆ Setup options
│ ◻ GitHub CLI
│ ◻ Reuse saved OpenRouter key
│ ◻ Chrome browser (~400 MB — enables web tools)
│ ◻ Telegram (connect via bot token from @BotFather)
│ ◻ WhatsApp (scan QR code via web dashboard after launch)

Security Requirements

• MUST NOT use command-line interpolation for bot tokens (prevents command injection)
• Use JSON config file upload or env var passing
• Follow existing shellQuote() conventions for any shell execution
• Add test coverage for token handling

References

• Closed PR: feat: add Telegram and WhatsApp to OpenClaw setup picker #2523
• Prior security reviews identified and fixed command injection vulnerabilities in token handling
• Test coverage should include: token injection, env var overrides, graceful skipping

[AhmedTMM]

This is already implemented on main. The Telegram and WhatsApp setup options were merged as part of PR #2545 and related PRs:

• Telegram: checkbox in setup picker, prompts for bot token (or reads TELEGRAM_BOT_TOKEN env var), injects into openclaw config via JSON file upload (no command injection risk)
• WhatsApp: checkbox in setup picker, interactive QR scan session runs before TUI launch, skipped in headless mode
• Tests: coverage in openclaw-config.test.ts and orchestrate-messaging.test.ts
• Security: bot tokens handled via shellQuote() and atomic JSON config writes

The original PR #2523 was superseded by these merged changes.

[AhmedTMM]

Already on main — the Telegram/WhatsApp setup was merged as part of PR #2545. PR #2523 was closed because its changes were already included.