Add configurable group access policy

[AlexToros]

Summary

• add a groupAccess policy for Telegram and Mattermost with allowlist and everyone modes
• support a platform-level default with optional per-bot overrides
• preserve everyone for existing configs while scaffolding new profiles with allowlist
• reject unauthorized group messages before sessions or attachment downloads
• keep each Telegram and Mattermost binding alive independently and retry transient initialization failures in the background
• document access policies and retry behavior in the existing configuration and platform chat sections

Tests

• npm test (285 passed)
• targeted Telegram and Mattermost startup-recovery tests
• npm pack --dry-run --cache /private/tmp/anyagent-npm-cache
• git diff --check

The local Mattermost Docker E2E could not start because neither configured Docker daemon was running (the selected Lima socket does not exist). The deterministic Mattermost runtime and contract tests pass.

Resource-call / N+1 check

The access filtering and retry changes operate per binding and do not add resource calls inside collection-processing paths. Multiple input messages still use the existing update-processing path; the change does not add one resource request per input item. Unauthorized Telegram attachments are rejected before getFile or download work.