feat(feishu): operator-configurable bot admission and mention policy

[Roy-oss1]

What does this PR do?

Adds two operator-facing toggles for inbound Feishu admission, addressing several long-standing requests for require_mention=false support and laying groundwork for bot-to-bot scenarios such as A2A orchestration and inter-bot notifications:

• FEISHU_ALLOW_BOTS=none|mentions|all (default: none) — control whether messages from other bots are accepted, optionally requiring an @mention.
• FEISHU_REQUIRE_MENTION=true|false (default: true) — control whether group messages must @mention the bot, with per-chat override via group_rules.<chat_id>.require_mention.

Inbound admission is consolidated into a four-step pipeline (self-echo → bot filter → DM bypass → group policy + mention) with explicit fail-closed behavior when the bot's self-identity is unresolved. Admitted peer bots bypass the human-user allowlist (matching existing Discord behavior). yaml feishu.allow_bots is bridged to the env var so the adapter and gateway auth layer share one source of truth — same pattern as Slack.

Defaults preserve prior behavior; existing operators see no change unless they opt in.

Related Issue

Fixes #10275
Fixes #15226
Fixes #9835
Fixes #5465

Type of Change

• ✨ New feature (non-breaking change that adds functionality)

Changes Made

• gateway/platforms/feishu.py — admission pipeline (_admit), self-identity hydration via /open-apis/bot/v3/info, peer-bot name resolution via /open-apis/bot/v3/bots/basic_batch, reaction-routing fix for peer-bot messages, FEISHU_ALLOW_BOTS / FEISHU_REQUIRE_MENTION settings, fail-closed self-id check.
• gateway/run.py — table-driven platform_allow_bots_map so admitted peer bots bypass the human user allowlist (collapses the existing Discord DISCORD_ALLOW_BOTS has no effect without also adding the bot to DISCORD_ALLOWED_USERS #4466 special-case and the new Feishu one into one clause).
• gateway/config.py — bridge feishu.allow_bots yaml → FEISHU_ALLOW_BOTS env so both layers see one source of truth.
• tests/gateway/feishu_helpers.py — shared fixtures for cross-test reuse.
• tests/gateway/test_feishu_bot_admission.py — parametrized matrices for the admission pipeline (19 cases) and _allow_group_message (12 cases) plus call-count, hydration, and event-dispatch tests.
• tests/gateway/test_config.py — yaml→env bridge tests.
• tests/gateway/test_feishu.py — peer-bot reaction routing regression test.
• website/docs/user-guide/messaging/feishu.md + website/docs/reference/environment-variables.md — new sections for FEISHU_REQUIRE_MENTION, Bot Identity, Bot-to-Bot Messaging (with required application:bot.basic_info:read scope), per-group require_mention override, troubleshooting entries.

How to Test

1. Default behavior (regression check): start the gateway with no new env vars set; group chats still require @mention and peer-bot messages are still ignored.
2. FEISHU_REQUIRE_MENTION=false: set the env var, run hermes gateway, send a non-mention message in a group chat — Hermes responds.
3. Per-chat override: add platforms.feishu.extra.group_rules.<chat_id>.require_mention: false to ~/.hermes/config.yaml; that chat skips the mention requirement, others inherit the global default.
4. Bot-to-bot via env: set FEISHU_ALLOW_BOTS=mentions, have a peer bot @mention Hermes from another app — message is processed. Without the mention, it's dropped.
5. Bot-to-bot via yaml: set feishu.allow_bots: all in ~/.hermes/config.yaml; peer bots are admitted without mention.
6. Self-echo protection: even with FEISHU_ALLOW_BOTS=all, Hermes' own outbound messages remain filtered.
7. Peer-bot names: with application:bot.basic_info:read granted, peer bots show by display name; without it, they show as ou_xxxxxx.
8. Run the test suite: pytest tests/gateway/test_feishu.py tests/gateway/test_feishu_bot_admission.py tests/gateway/test_feishu_bot_auth_bypass.py tests/gateway/test_config.py -q.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.2

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[teknium1]

Salvaged via #18208 — merged onto current main with your commit authorship preserved via rebase-merge. Thanks for the clean, well-tested patch (1100 LOC of tests, 295/295 passing, reaction-routing bug nicely caught). The four linked issues (#10275, #15226, #9835, #5465) are now resolved.