fix: Telegram Bot Token 脱敏 — GET 不返回明文，reveal 需密码验证

- 后端 SENSITIVE_KEYS 加入 telegram_bot_token，GET /settings/ 返回脱敏值
- 新增 POST /settings/telegram/reveal-token 端点（密码验证 + 审计日志）
- 前端 Telegram 区域独立渲染：Bot Token 默认脱敏，点"显示"需输入密码
- Chat ID 保持可编辑（非敏感信息）
- Bot Token 输入框默认 type=password，可切换明文/遮掩

server/api/settings.py

@@ -27,7 +27,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 IMMUTABLE_KEYS = {"secret_key", "api_key", "encryption_key", "database_url"}
 
 # Settings whose values are masked in GET responses
-SENSITIVE_KEYS = {"secret_key", "api_key", "encryption_key"}
+SENSITIVE_KEYS = {"secret_key", "api_key", "encryption_key", "telegram_bot_token"}
 
 router = APIRouter(prefix="/api/settings", tags=["settings"])
 
@@ -702,6 +702,40 @@ async def telegram_test_send(
     raise HTTPException(status_code=502, detail="Telegram API 返回错误，请检查 Bot Token 和 Chat ID")
 
 
+@router.post("/telegram/reveal-token", response_model=dict)
+async def reveal_telegram_token(
+    payload: ApiKeyRevealRequest,
+    request: Request,
+    admin: Admin = Depends(get_current_admin),
+    db: AsyncSession = Depends(get_db),
+):
+    """Reveal Telegram Bot Token after re-entering account password."""
+    from server.infrastructure.database.admin_repo import AdminRepositoryImpl
+
+    admin_repo = AdminRepositoryImpl(db)
+    current = await admin_repo.get_by_id(admin.id)
+    if not current or not bcrypt.checkpw(
+        payload.current_password.encode(),
+        current.password_hash.encode(),
+    ):
+        raise HTTPException(status_code=400, detail="当前密码错误")
+
+    repo = SettingRepositoryImpl(db)
+    value = await repo.get("telegram_bot_token")
+    if value is None:
+        raise HTTPException(status_code=404, detail="telegram_bot_token not found")
+
+    audit_repo = AuditLogRepositoryImpl(db)
+    await audit_repo.create(AuditLog(
+        admin_username=admin.username,
+        action="reveal_telegram_token",
+        target_type="setting",
+        detail="查看 Telegram Bot Token",
+        ip_address=request.client.host if request.client else "",
+    ))
+    return {"key": "telegram_bot_token", "value": value}
+
+
 @router.get("/telegram/chats", response_model=dict)
 async def telegram_get_chats(
     admin: Admin = Depends(get_current_admin),