fix(gateway): validate user authorization before auto-resume

[ygd58]

Clean rebase of #23800 onto current main (egilewski flagged a merge conflict in gateway/run.py on the old branch).

Problem

Auto-resume of restart-interrupted sessions bypassed auth checks. The session owner was never validated against TELEGRAM_ALLOWED_USERS before the synthetic resume event was dispatched (issue #23778).

Fix

Check _is_user_authorized() for the session owner before scheduling auto-resume. Unauthorized sessions are skipped with a warning log.

Fixes #23778 (partial - auto-resume auth bypass)

[alt-glitch]

Resubmission of closed #23800 — clean rebase onto current main (the old branch had a merge conflict in gateway/run.py). This is the active version of that auth-bypass fix. Confirmed still live on main: _schedule_resume_pending_sessions dispatches synthetic resume events without calling _is_user_authorized() on the session owner, while the cold path (_handle_message) does check it. Related: #23778 (issue).

[egilewski]

obsolete

The issue this PR closes appears to be resolved already. Please reopen with a fresh target if this still covers a distinct gap.

Signed: GPT-5.5-low in Codex

[teknium1]

Merged via #56347 (rebase-merge, your fix commit authorship preserved in git log): #56347

Cherry-picked onto current main at the current _schedule_resume_pending_sessions site (the method moved since your branch) and covered with two tests — unauthorized owner skipped without claiming a slot, and fail-closed on a raising auth check. Thanks!