fix: scope Telegram sessions and plans to the requesting chat (M-2)

[jkyberneees]

Scopes Telegram session/plan commands to the requesting chat, closing cross-chat listing/resume/prune/read/delete paths (M-2).

Changes:

• internal/telegram/session.go: ListSessions, ResumeSession, PruneSessions now filter by tg- prefix; ResumeSession rejects IDs from other chats.
• internal/telegram/plan.go: plans stored under ~/.odek/plans/chat/; ListPlans/ReadPlan/DeletePlan/MostRecentPlan are chat-scoped (chatID 0 = global/admin scope).
• cmd/odek/telegram.go: /sessions, /resume, /prune, /plan, /plans, /plan_view, /plan_delete, /plan_resume wired to chat-scoped APIs.
• Added regression tests in internal/telegram/chat_scope_test.go and updated existing tests to match the new behavior.
• Updated docs/SECURITY.md, docs/TELEGRAM.md, and AGENTS.md.