Fill an empty Telegram connector from a token pasted in support chat - #1585

What and why

Follow-up to #1583. The first real case on Cloud (2026-11-08) was refused with "already has a Telegram connector": the workspace had a Telegram connector installed from the app picker without a token. Several other trial users are in the same state.

Now, when every Telegram connector of the workspace is still empty (address still https://api.telegram.org/bot{{TELEGRAM_BOT_TOKEN}} and no value for TELEGRAM_BOT_TOKEN), the oldest one gets the token in place instead of a new install:

• Same identity checks as before (verified widget contact, verified email, one workspace, ADMIN/EDITOR), same getMe check and daily limit.
• No plan-limit check: no connector is created.
• Re-reads the connector right before writing; if a token reached it meanwhile it is left alone.
• Writes through ConnectorsService.update (variables sealed at rest), then reloadConnectorTools and attach to the default server (no-op if attached).
• Security event and product event carry filledEmptyConnector: true; the same emails go to the user and the admins.
• A connector that holds a token (or whose address was edited) is still never touched.

The connector id stays the same, so ?connector=<id> links already sent in chats keep working.

Cloud and self-hosted

Cloud only, as before: SupportModule loads only with the support desk configured; self-hosted never loads it.

Tests

Working directory packages/backend:

• npx jest src/ee/support --maxWorkers=4 → 5 suites, 64 tests passed (new: fills the oldest empty connector, keeps other variables, leaves a connector that got a token meanwhile, a resolved address counts as set up, refused token fills nothing).
• npx tsc --noEmit -p tsconfig.json → no errors.
• npx eslint on the changed files → clean.