Remove hardcoded secrets; source credentials from configuration

The Telegram bot token was a const in AddChannels(), and the Mistral API
key was baked into the embedded Provider.Mistral.toml resource.

- Wire AddChannels() through the existing (previously unused)
  AddTelegramOptions(), which binds "Channels:Telegram" and validates on
  start. TelegramOptions is resolved from IOptions<> so TelegramAdapter
  and TelegramChannel are unchanged.
- Ship the embedded provider defaults with an empty ApiKey. Ollama's
  placeholder is now a non-secret literal.
- Re-apply AddEnvironmentVariables() last in AddLunaConfiguration() so
  env vars override the TOML sources; without this the embedded defaults
  would shadow injected credentials.

Credentials are now supplied via Providers__Mistral__ApiKey and
Channels__Telegram__BotToken, or via ~/.luna/providers/*.toml overrides.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Luna.Configuration/Resources/Providers/Provider.Mistral.toml

@@ -1,5 +1,4 @@
 
-ApiKey = "REDACTED-MISTRAL-API-KEY"
+ApiKey = ""
 ApiUrl = "https://api.mistral.ai/v1/"
 Models = ["mistral-small-latest"]
-

Luna.Configuration/Resources/Providers/Provider.Ollama.toml

@@ -1,5 +1,4 @@
 
-ApiKey = "apfelkuchen"
+ApiKey = "ollama"
 ApiUrl = "http://localhost:11434/"
 Models = ["mistral-nemo:12b"]
-