telegram_bot: credentials/quality/scan-loops from config.json, startup guard

- Credentials, alert quality, scan pairs/timeframes, log level and
  candle-loop intervals now resolve via app_config (env -> config.json
  -> code default) instead of hardcoded fallbacks.
- _get_shared_dp() uses make_data_provider() for provider-registry
  dispatch.
- main() refuses to start without a token/chat_id, raising SystemExit
  with an actionable message instead of a bare sys.exit string.
- test_all.py Module 13: two new tests covering credential/quality/
  loop wiring via a reload, and the startup guard.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VPNF37MP9Kuv62B1VBrZ1b

test_all.py

@@ -2766,6 +2766,43 @@ def _():
         "credentials must not live in committed source"
 
 
+@test("telegram_bot: credentials, quality, pairs, loops from app_config")
+def _():
+    import importlib
+    import telegram_bot
+    app = AppConfig(telegram_token="json-tok", telegram_chat_id="42",
+                    telegram_channel_id="", alert_min_quality="B",
+                    scan_timeframes=[Timeframe.M15, Timeframe.H1],
+                    provider_settings={"twelve_data": {"api_key": "k"}})
+    set_app_config(app)
+    try:
+        with patch.dict(os.environ, {}, clear=True):
+            tb = importlib.reload(telegram_bot)
+            assert tb.TOKEN == "json-tok"
+            assert tb.OWNER_ID == 42
+            assert tb.CHANNEL_ID is None, '"" channel id must disable the feed'
+            assert tb._alert_min_quality == "B"
+            assert [tf for tf, _ in tb._AUTOSCAN_LOOPS] == \
+                [Timeframe.M15, Timeframe.H1]
+            assert tb._AUTOSCAN_LOOPS == [(Timeframe.M15, 15),
+                                          (Timeframe.H1, 60)]
+    finally:
+        set_app_config(_TEST_APP)
+        importlib.reload(telegram_bot)
+
+
+@test("telegram_bot: main() refuses to start without credentials")
+def _():
+    import telegram_bot
+    if telegram_bot.TOKEN:      # only meaningful in the hermetic no-cred env
+        return
+    try:
+        telegram_bot.main()
+        assert False, "main() must refuse to start without token/chat_id"
+    except SystemExit as e:
+        assert "credentials" in str(e)
+
+
 # ══════════════════════════════════════════════════════════════════════
 #  SUMMARY
 # ══════════════════════════════════════════════════════════════════════