feat(ws3): ADR-093 Callback User-ID Binding + ADR-094 Webhook 入口

## T3.1/T3.2 Bound User Check（security_interceptor.py）
- verify_callback() Step 0: 檢查 Redis cb_bind:{nonce}
  → 若有 binding 且 caller != bound_user_id → UserNotWhitelistedError
  → 若 key 不存在（舊格式）→ 降級走 whitelist（向後相容）
  → 若 Redis unavailable → 降級繼續（安全降級）
- bind_callback_user(nonce, user_id): async 方法，TTL=48h

## T3.3 Telegram Webhook 入口（ADR-094）
- apps/api/src/api/v1/telegram_webhook.py（新建）
  POST /api/v1/telegram/webhook
  - X-Telegram-Bot-Api-Secret-Token header 驗證
  - TELEGRAM_WEBHOOK_SECRET="" → dev 跳過（不 break 現有測試）
  - WS4 Hermes NL 接入預留佔位

## T3.4 config.py
- 新增 TELEGRAM_WEBHOOK_SECRET field（預設空字串）

## main.py
- 掛載 telegram_webhook_v1.router 到 /api/v1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/main.py

@@ -68,6 +68,7 @@ from src.api.v1 import monitoring as monitoring_v1  # 2026-04-03: 監控工具
 from src.api.v1 import notifications as notifications_v1  # 2026-04-10: 通知頻道狀態
 from src.api.v1 import stats as stats_v1  # Phase 6.5: Statistics Analytics
 from src.api.v1 import telegram as telegram_v1  # Phase 5.4: Telegram Gateway
+from src.api.v1 import telegram_webhook as telegram_webhook_v1  # ADR-094: Webhook入口
 from src.api.v1 import terminal as terminal_v1  # Phase 19.1: Omni-Terminal SSE
 from src.api.v1 import timeline as timeline_v1
 from src.api.v1 import webhooks as webhooks_v1
@@ -719,6 +720,9 @@ app.include_router(
 app.include_router(
     telegram_v1.router, prefix="/api/v1", tags=["Telegram Gateway"]
 )  # Phase 5.4
+app.include_router(
+    telegram_webhook_v1.router, prefix="/api/v1", tags=["Telegram Webhook"]
+)  # ADR-094: Webhook 入口（WS4 Hermes NL 預留）
 app.include_router(
     metrics_v1.router, prefix="/api/v1", tags=["Gold Metrics"]
 )  # Phase 7: 真實血脈