fix(simplex): authorize allowed-group messages at the gateway

[Que0x]

What & why

SimpleX group messages were silently dropped even when the operator opted the group in via SIMPLEX_GROUP_ALLOWED.

The adapter gates group messages against SIMPLEX_GROUP_ALLOWED at intake, but never carried that decision to the gateway. _is_user_authorized then re-checked the sending group member against SIMPLEX_ALLOWED_USERS — a DM-contact allowlist that group members aren't in — so the message was denied. This contradicts the documented behavior ("a bot in a group … processes every member's traffic").

Fix

Set role_authorized=True on the source once a group message clears the SIMPLEX_GROUP_ALLOWED gate — the same signal the Discord adapter sets after a role check, which the gateway already honors. One line + a comment in the adapter.

Not a fail-open: DMs stay gated by SIMPLEX_ALLOWED_USERS, and with SIMPLEX_GROUP_ALLOWED unset, group messages are dropped before this point.

Tests

Added 5 tests to tests/gateway/test_simplex_plugin.py:

• allowed-group message → source carries role_authorized=True
• group outside the allowlist → dropped (fail-closed)
• DM message → role_authorized=False (stays gated)
• gateway end-to-end: group source with role_authorized is authorized even when the member isn't in SIMPLEX_ALLOWED_USERS
• gateway end-to-end: same source without role_authorized is denied

Results:

• tests/gateway/test_simplex_plugin.py — 35 passed
• authz suite (simplex, discord, telegram, relay, config-policy, unauthorized-dm) — 180 passed
• mutation check: reverting the fix fails the new guards

[teknium1]

Thanks for the focused SimpleX authorization fix. The premise remains valid on current main: plugins/platforms/simplex/adapter.py:532-547 admits configured groups, but its source construction at :613-619 does not propagate that admission. gateway/authz_mixin.py:436-437 already honors the proposed boolean, while unmarked SimpleX sources fall through to member-based SIMPLEX_ALLOWED_USERS matching at :590-605.

The adapter's only build_source() call is on this common inbound path (plugins/platforms/simplex/adapter.py:472-667), including deferred-file replay, so the change covers the adapter's inbound message types. The added adapter and gateway-boundary tests are behavior-oriented and match the existing role_authorized contract.

The surrounding current-main hunk remains compatible with the PR diff, so this should be mechanically salvageable.

Automated hermes-sweeper review.