fix: guard int/float env var casts against invalid values

[vanthinh6886]

Summary

Multiple gateway files cast os.getenv() results directly with int() or float() without try/except. If a user sets an invalid value (e.g. HERMES_MAX_ITERATIONS=abc), the gateway crashes with ValueError on startup or message handling.

Fix

• utils.py: Add env_float() companion to existing env_int() — both catch ValueError/TypeError and return the default.
• gateway/run.py: Use env_int() for HERMES_MAX_ITERATIONS at 2 call sites.
• gateway/platforms/feishu.py: Use env_int()/env_float() for 5 Feishu config env vars.
• gateway/platforms/api_server.py: Wrap HERMES_MAX_ITERATIONS in try/except (api_server does not import utils).

Changes

• 4 files, +26/-12 lines

Existing _env_int/_env_float helpers in telegram.py and chat_completion_helpers.py are left as-is to keep this PR focused.

[alt-glitch]

Related: #39113 (guards float()/int() env casts across 27 files / 52 locations) and #41646 (gateway+plugins, 20 locations) both already cover the gateway env-cast guards in this PR (gateway/run.py, gateway/platforms/feishu.py, gateway/platforms/api_server.py) using the same env_int/env_float approach. This PR is a narrower subset of those broader open PRs, plus it adds the env_float() companion helper to utils.py. Not a duplicate — flagging the overlap so reviewers can decide whether to consolidate.

[alaamohanad169-ship-it]

Note: This is NOT a duplicate of the prior closed PRs (#39113, #41646). The earlier PRs were closed because they were stale (far behind upstream main). This version has been cherry-picked onto the latest origin/main with a clean diff containing only the fix changes. No conflicts. CI green. Ready for review.

[kshitijk4poor]

Closing as superseded by #49558, which landed the canonical fix for this whole bug class.

#49558 adds env_float() alongside the existing env_int() in utils.py (the env_float helper was cherry-picked from this PR — @annguyenNous's authorship is preserved in the merge, commit 06ca1e998), then converts all 22 genuinely-unguarded first-party int/float(os.getenv()) sites across the gateway, agent, auth, and platform adapters to those canonical helpers.

We went with the utils.env_int/env_float route (the established house pattern, already imported in several modules) rather than per-module helpers or inline try/except, so every malformed-env crash site is now guarded through one shared implementation.

Thanks for spotting and driving the fix on this — it's all in main now via:
#49558