fix(qqbot): allow DM approval button authorization

[shttty]

Summary

• Treat QQ private-chat dm session keys as aliases of QQ c2c interaction events during approval button authorization.
• Keep the existing operator/openid equality check so other users cannot approve another user's pending action.
• Add regression coverage for the dm session key + c2c event mismatch.

Why

QQ private chat messages are stored in Hermes session keys as agent:main:qqbot:dm:<openid>, but QQ button interaction events report the scene as c2c. The old authorization path only accepted chat_type == "c2c", so the rightful user clicking their own approval button in a DM could be rejected as unauthorized.

Observed symptom:

Rejected unauthorized approval click for session agent:main:qqbot:dm:<openid>

Test plan

• python3 -m py_compile gateway/platforms/qqbot/adapter.py tests/gateway/test_qqbot.py
• uv run --extra dev --extra messaging python -m pytest tests/gateway/test_qqbot.py -q

Result:

163 passed, 4 warnings in 3.93s

[alt-glitch]

Related: #35760 (the c2c-vs-dm chat_type mismatch bug this fixes), #46154 (earlier closed attempt at the same fix). Resubmission after #46154 was closed unmerged; this PR aliases dm to c2c in _is_authorized_interaction_for_session while preserving the operator == chat_id equality check.

[teknium1]

Thanks for the focused QQBot authorization fix. Current main still creates QQ C2C message sessions as dm (gateway/platforms/qqbot/adapter.py:1291-1297) while _is_authorized_interaction_for_session only accepts c2c (gateway/platforms/qqbot/adapter.py:1101-1113), causing the approval rejection path at gateway/platforms/qqbot/adapter.py:1148-1154.

The proposed dm alias retains the existing operator == chat_id check, and the added matching/non-matching operator cases cover the direct authorization contract. This is a narrow gateway-adapter change with no new configuration or tool surface.

Automated hermes-sweeper review.