Telegram: find the token in pasted text, no password autofill, clear error

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/telegram.rs

@@ -149,6 +149,12 @@ impl Bot {
     }
 }
 
+/// Find the bot token in what the user pasted (also the whole BotFather message).
+pub fn extract_token(input: &str) -> Option<String> {
+    let re = regex::Regex::new(r"\b(\d{5,}:[A-Za-z0-9_-]{30,})\b").unwrap();
+    re.captures(input).map(|c| c[1].to_string())
+}
+
 /// Check a token and return the bot's username.
 pub async fn check_token(token: &str) -> Result<String> {
     let me = Bot { token: token.to_string() }.call("getMe", json!({})).await?;
@@ -1145,6 +1151,14 @@ mod tests {
         }
     }
 
+    #[test]
+    fn finds_the_token_in_pasted_text() {
+        let msg = "Done! Congratulations on your new bot.\nUse this token to access the HTTP API:\n7123456789:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw4\nKeep your token secure";
+        assert_eq!(extract_token(msg).as_deref(), Some("7123456789:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw4"));
+        assert_eq!(extract_token(" 7123456789:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw4 ").as_deref(), Some("7123456789:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw4"));
+        assert_eq!(extract_token("my-password-123"), None);
+    }
+
     #[test]
     fn step_lines() {
         assert_eq!(step_line("bash", &json!({"command": "cargo test\nmore"})), "bash: cargo test");