fix(bluebubbles): parse nested auth-key group webhooks

[tmchow]

Summary

• handle BlueBubbles group webhook payloads whose stable chat GUID is nested under data.chats[0]["[auth-key]"]
• use nested chatIdentifier / identifier / displayName as fallback chat identifiers
• treat BlueBubbles style >= 43 as group evidence for mention gating
• add regression tests that replay the sanitized payload through _handle_webhook()
• isolate BlueBubbles tests from ambient BLUEBUBBLES_MENTION_PATTERNS env

Why

This covers a payload shape not handled by the existing chats[0].guid fallback from #8514 / #9806. Without it, Hermes can lose group chat identity and treat a group webhook as a DM.

Fixes #38339.

Test plan

/Users/amosclaw/.hermes/hermes-agent/venv/bin/python -m pytest tests/gateway/test_bluebubbles.py -o addopts= -q
58 passed in 0.51s

git diff --check

[tmchow]

I opened #38379 as a combined fix that includes this payload-shape fix plus the duplicate/update-echo ordering fix from #30708.

This PR (#38342) is still correct for the nested [auth-key] group payload, but by itself it does not stop BlueBubbles updated-message echoes from producing a second route/session. Conversely, #30996 stops duplicate replies but can still preserve the wrong route if the sparse update event arrives first.

#38379 combines the two requirements:

• skip updated-message echoes before dedup so they cannot claim the GUID first
• parse data.chats[0]["[auth-key]"] and nested identifiers on the real new-message
• test reverse order: updated-message first, then new-message, verifying the final event routes as group

If #38379 lands, this PR can be considered superseded.

[teknium1]

Thanks for the focused BlueBubbles regression fix. The premise remains on current main: gateway/platforms/bluebubbles.py:977-988 only reads the conventional nested GUID and top-level identifiers; :1001-1007 can then fall back to the sender and classify the event as a DM. The PR adds the missing nested [auth-key] and identifier sources, plus style >= 43 group evidence, at the same webhook resolution point.

The added tests exercise _handle_webhook() rather than only helper extraction and verify both mention suppression and the resulting group source route. The contributor's follow-up correctly identifies updated-message ordering as a separate concern tracked by still-open #38379; it does not invalidate this payload-shape fix.

Automated hermes-sweeper review.