fix(telegram): sanitize download filenames

[I3eka]

Summary

• sanitize both registry keys and Telegram-provided names before creating local download paths
• replace Windows-invalid and control characters, and trim trailing dots or spaces
• add regression coverage for photo keys and unsafe document names

Testing

• go test ./...

[Copilot]

🟢 Ready to approve

The sanitization logic is applied at the right boundary (path construction), and the added unit tests cover the intended regression scenarios without introducing behavioral risks elsewhere.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR hardens the local download-path generation in internal/telegram by sanitizing both the internal registry key and Telegram-provided filenames, aiming to prevent invalid/unsafe filenames (notably on Windows) and to avoid path-related surprises.

Changes:

• Sanitize both halves of the generated download filename (registry key + Telegram filename) before joining into the storage directory path.
• Add sanitizeDownloadFileName helper to replace Windows-invalid/control characters and trim trailing dots/spaces.
• Add a small regression test suite covering photo keys and unsafe document names.

File summaries

File	Description
internal/telegram/files.go	Applies centralized filename sanitization when generating the download target path; adds the sanitization helper.
internal/telegram/files_test.go	Adds regression tests to ensure expected sanitization behavior for common/unsafe inputs.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.