fix(telegram): persist private-chat topic sessions

[Dvredin]

What

• scope chat-mode session keys by message_thread_id for Telegram private chats
• keep the main private-chat session on (chat_id, None)
• preserve existing supergroup forum-topic routing through TopicStateStore
• cover persistence, topic isolation, end-to-end resume, and /new clearing

Why

Private-chat topic messages carry message_thread_id, but _chat_session_key() rejected every threaded message. With forum topic management disabled, no other store handled those messages, so each follow-up started a fresh agent session.

Fixes #734.

Testing

• uv run pytest --ignore=tests/test_trigger_actions.py — 3134 passed, 1 skipped; 82.99% coverage
• uv run pytest --no-cov tests/test_trigger_actions.py -q — 31 passed
• focused routing/store/end-to-end suite — 11 passed
• regression test proven to fail against the old _chat_session_key() behaviour
• uv run ruff check src tests
• uv run ruff format --check src tests
• uv lock --check
• docs prebuild + Zensical build
• wheel/sdist build, Twine check, and check-wheel-contents
• Bandit

Existing baseline findings

• ty remains informational in CI and reports pre-existing diagnostics; none are introduced in the changed lines.
• pip-audit reports the existing aiohttp 3.14.1 advisories from origin/dev; this PR does not change uv.lock.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5f4c319e-a9da-4597-85c5-5c5e412c8368

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Dvredin]

Closing as superseded by #744, which merged the #734 fix into dev in commit f7f6abf. I verified the merged implementation on the current dev: the focused Telegram session suite passed (117 passed), Ruff passed, and uv lock --check passed. Rebasing this PR would leave a duplicate/empty change rather than a meaningful conflict resolution.