Admin access control: group admins, ADMIN_ONLY flag, and /credits consolidation

[robdevops]

Summary

Implements admin access control based on both configured admin IDs and group administrator status, adds an ADMIN_ONLY flag to restrict DM and portfolio access, and consolidates /credits and /usage into a single /credits command.

Key Changes

Admin Access System

• New lib/telegram/access.py module: is_admin() checks if a user is in ADMIN_CHAT_IDS or administers any group the bot has seen
• Caches group admin lists for 5 minutes to avoid repeated Telegram API calls
• Handles Telegram errors gracefully (treats inaccessible groups as having no admins)
• Tracks known groups via Ctx.group_admins dict

ADMIN_ONLY Flag

• New ADMIN_ONLY config setting (defaults to on)
• When enabled: only admins can DM the bot; non-admins get no response
• Portfolio data (Sharesight) restricted to admins only; others see "Portfolio data is for admins only."
• When disabled: everyone can DM and access all tools
• Group membership tracking now happens whenever ADMIN_ONLY is on (via ChatMemberHandler)

Command Changes

• /credits now shows both provider balance and usage stats (tokens, cost per model for last 24h and 7 days)
• /usage command removed; functionality merged into /credits
• Both commands now use is_admin() instead of just checking ADMIN_CHAT_IDS
• Group admins can run /credits in their group or via DM

Tool Gating

• Non-admin users never receive portfolio-gated tools (Sharesight) in either initial or retry requests
• ask.py adds admin parameter to filter servers based on user privilege level
• New _public() helper excludes portfolio-gated servers

Message Handling

• handlers.on_message checks admin status for private messages when ADMIN_ONLY is on
• Group membership updates are tracked to maintain the admin cache
• Removed post_to_groups flag check from message recording (groups are always tracked when needed)

Implementation Details

• Admin checks are async and use asyncio.to_thread for store operations
• Cache expiry uses time.monotonic() for robustness against system clock changes
• Telegram errors (e.g., bot removed from group) are logged as warnings and treated as "no admins"
• The /credits command gracefully handles backend failures while still showing usage data
• Tests cover: listed admins, group admins, cache behavior, error handling, and non-admin restrictions

https://claude.ai/code/session_014k4kywyN5dAo39izUPvxbw