Fix WeCom media decryption for unpadded aeskey

[freefish1218]

Summary

Fix WeCom inbound media decryption when the message aeskey is sent as an unpadded Base64 string.

What changed

• Normalize inbound WeCom media aeskey before Base64 decoding
• Accept 43-character unpadded keys returned by WeCom media messages
• Add a regression test covering unpadded aeskey

Why

In real WeCom bot traffic, inbound image media could fail with:

Incorrect padding

The adapter was decoding aeskey with base64.b64decode(aes_key) directly. Some WeCom media messages provide the AES key in unpadded Base64 form, so decoding fails before AES-CBC decryption begins.

This patch pads the key to a multiple of 4 before decoding, matching the behavior used by other WeCom implementations.

Validation

Production validation:

• Verified against a real production failure where inbound WeCom image messages failed with Incorrect padding
• Confirmed the fix by successfully receiving, decrypting, caching, and analyzing a WeCom image after the change

Automated tests:

• ./.venv/bin/python -m pytest -q tests/gateway/test_wecom.py -k "decrypt_file_bytes" -> 2 passed
• ./.venv/bin/python -m pytest -q tests/gateway/test_wecom.py -> 41 passed

[freefish1218]

Tests completed locally:

• ./.venv/bin/python -m pytest -q tests/gateway/test_wecom.py -k "decrypt_file_bytes" -> 2 passed
• ./.venv/bin/python -m pytest -q tests/gateway/test_wecom.py -> 41 passed

[alt-glitch]

Likely duplicate of #11899 — same WeCom unpadded Base64 aeskey decryption fix. See also #10085 and #12390 for overlapping PRs in the same area.

[teknium1]

Thanks for the focused report and regression test. This is already implemented on current main; this is an automated hermes-sweeper review.

• Commit 8f4c0bf0882c3c7258a65e3adade12d5b08068ea (fix(wecom): pad base64 AES key before decode) added the same Base64-padding behavior before decoding.
• Current code retains the exact guarantee at plugins/platforms/wecom/adapter.py:1069-1071: it pads aes_key to a multiple of four before calling base64.b64decode.
• The original target was subsequently migrated from gateway/platforms/wecom.py to the bundled plugin by 5600105478ffde29d7566b45421b100eaa29c4ef.
• The fix is contained in release tag v2026.5.7; the duplicate discussion referencing fix(wecom): accept urlsafe unpadded inbound aeskey #11899 is consistent with this result.