feat(telegram): port wave-1 fixes + @api set_secret write-door (DPLAN-0220)

Surfaced by a full completeness audit of the telegram skill against
TELEGRAM_PORT_MAP.md (366 tags, ~83% ported, 452/452 tests green).

@api — in-process set_secret(provider, slug, value, *, as_json) writer
mirroring get_secret (0o600 files / 0o700 dirs, no stdout echo). The store
was read-only; this is the GAP1 enabler the telegram mother-bot needs to
persist a created bot's config. 515 @api tests, seedgo 100%.

@skills telegram wave-1 (fix-forward, no deletions):
- GAP2: bot_factory + telegram-bot@.service launched a non-existent
  ~/.venv/bin/python3; now sys.executable -m ...base_bot (+ lib/__init__.py
  and lib/telegram/__init__.py for package resolution).
- Reboot survival: enable_service now installs the unit to
  ~/.config/systemd/user/ + daemon-reload (was never installed).
- GAP9: gitignore lib/telegram/.local/ so runtime state stops leaking to git.
- prax-monitor: log_streamer now resolves repo-root system_logs (honoring
  AIPASS_TEST_LOG_DIR) instead of a hardcoded ~/system_logs.

Verified: telegram 452/452 green (twice), base_bot imports via -m.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QEQZXCtgnF3NQtcttTErpq

src/aipass/api/README.md

@@ -5,8 +5,8 @@
 > Centralized external API gateway — authenticated service clients for all external APIs
 
 **Module:** `aipass.api` | **Role:** `api_gateway`
-**Seedgo:** 100% (37/37 at 100%) | **Tests:** 504 pass | **Functions:** 82 public (82 tested)
-**Last Updated:** 2026-06-15
+**Seedgo:** 100% (38/38 at 100%) | **Tests:** 515 pass | **Functions:** 84 public (84 tested)
+**Last Updated:** 2026-06-24
 
 ---
 
@@ -68,7 +68,7 @@ api/
 │   │   └── usage/aggregation.py, cleanup.py, tracking.py
 │   └── integrations/                  # Private driver space (gitignored)
 │       └── {project}/driver.py
-└── tests/                             # 504 tests across 28 files
+└── tests/                             # 515 tests across 28 files
 ```
 
 Three-tier: entry point routes to modules (orchestration), modules delegate to handlers (business logic). Modules auto-discovered from `apps/modules/*.py` via `handle_command()`.
@@ -88,11 +88,12 @@ service = get_drive_service(thread_safe=True)   # For concurrent workers
 from aipass.api.apps.modules.google_client import get_google_service
 service = get_google_service("calendar", "v3")
 
-from aipass.api.apps.modules.secrets import get_secret, list_secrets
+from aipass.api.apps.modules.secrets import get_secret, set_secret, list_secrets
 token = get_secret("telegram", "bot")               # Returns bot_token string
 config = get_secret("telegram", "bot", as_json=True) # Returns full dict
-slugs = list_secrets("telegram")                     # Returns ["bot", "webhook", ...]
-# CLI never prints raw values — use the Python API above for programmatic access
+set_secret("telegram", "newbot", cfg, as_json=True)  # Writes ~/.secrets/aipass/telegram/newbot.json
+slugs = list_secrets("telegram")                     # Returns ["bot", "newbot", ...]
+# Values never reach stdout — use the Python API above for programmatic access
 ```
 
 ---
@@ -128,6 +129,6 @@ Private drivers in `apps/integrations/{project}/driver.py` (gitignored) register
 
 ---
 
-*Last Updated: 2026-05-16*
+*Last Updated: 2026-06-24*
 
 [← Back to AIPass](../../../README.md)