Connect an organization Telegram bot

Admin-only. Validates a BotFather token, binds it to one organization worker, encrypts it at rest, and registers a secret-protected webhook.