Fix token patching: gateway.token, hooks.token, telegram.botToken all from OCP env vars; scale replicas to 1

manifests/deployment.yaml

@@ -30,12 +30,18 @@ spec:
                   --gateway-port 18789 --gateway-bind lan \
                   --skip-daemon --skip-channels --skip-skills --skip-health --skip-ui
               fi
-              # Patch hooks.token from OCP secret if not already set (idempotent)
-              if ! grep -q '"token":' ~/.openclaw/openclaw.json 2>/dev/null; then
+              # Patch tokens from OCP secrets into openclaw.json if not already set (idempotent)
               node -e "
                 const fs = require('fs');
                 const d = JSON.parse(fs.readFileSync(process.env.HOME + '/.openclaw/openclaw.json', 'utf8'));
-                  d.hooks = d.hooks || {};
+
+                // Gateway token — must be in openclaw.json for channel auth to work
+                if (!d.gateway) d.gateway = {};
+                if (!d.gateway.token) d.gateway.token = process.env.OPENCLAW_GATEWAY_TOKEN;
+
+                // Hooks token
+                if (!d.hooks) d.hooks = {};
+                if (!d.hooks.token) {
                   d.hooks.token = process.env.HOOKS_TOKEN;
                   d.hooks.enabled = true;
                   d.hooks.path = '/hooks';
@@ -57,10 +63,18 @@ spec:
                       timeoutSeconds: 60
                     });
                   }
+                }
+
+                // Telegram bot token
+                d.channels = d.channels || {};
+                d.channels.telegram = d.channels.telegram || {};
+                if (!d.channels.telegram.botToken) {
+                  d.channels.telegram.botToken = process.env.TELEGRAM_BOT_TOKEN;
+                }
+
                 fs.writeFileSync(process.env.HOME + '/.openclaw/openclaw.json', JSON.stringify(d, null, 2));
-                  console.log('hooks.token patched from HOOKS_TOKEN env var');
+                console.log('Tokens patched from OCP env vars');
               "
-              fi
               exec node /app/openclaw.mjs gateway --port 18789 --bind lan
           ports:
             - name: gateway