fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

Summaryfast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP clien...