fix(whatsapp_cloud): honor documented WHATSAPP_CLOUD_ALLOWED_USERS / ALLOW_ALL_USERS

[sahil-shubham]

Problem

The WhatsApp Cloud setup wizard (hermes whatsapp-cloud) and the Cloud API docs tell operators to set WHATSAPP_CLOUD_ALLOWED_USERS (and optionally WHATSAPP_CLOUD_ALLOW_ALL_USERS).

But the adapter's DM intake gate — _should_process_message → _is_dm_intake_allowed in whatsapp_common.py — only reads WHATSAPP_CLOUD_ALLOW_FROM + WHATSAPP_CLOUD_DM_POLICY (default open, opted-in only via GATEWAY_ALLOW_ALL_USERS / WHATSAPP_ALLOW_ALL_USERS).

So an allowlist configured exactly as documented silently drops every inbound message:
_build_message_event_from_cloud → _should_process_message returns False → returns None → webhook responds HTTP 200, nothing is dispatched, and no log line is emitted.

This is very hard to diagnose: the webhook verification, X-Hub-Signature-256, app subscription, and WABA subscribed_apps all look correct, and /health shows accepted: 0 with rejected_signature: 0. It reads exactly like "Meta isn't delivering," when in fact Meta is delivering and the message is dropped at the adapter gate.

Fix

gateway/platforms/whatsapp_cloud.py:

• _allow_from now also reads WHATSAPP_CLOUD_ALLOWED_USERS (in addition to WHATSAPP_CLOUD_ALLOW_FROM).
• dm_policy now defaults to allowlist when an allowlist is configured (else open), so a documented allowlist is actually enforced instead of silently dropping.
• _open_dm_opted_in() is overridden to also honor WHATSAPP_CLOUD_ALLOW_ALL_USERS.

Explicit WHATSAPP_CLOUD_DM_POLICY / WHATSAPP_CLOUD_ALLOW_FROM still take precedence, so this is fully backward compatible.

Testing

Verified on a live Cloud API test number:

• Documented config only (WHATSAPP_CLOUD_ALLOWED_USERS=<listed>, no DM_POLICY/ALLOW_FROM): listed sender is processed, a non-listed sender is dropped, accepted increments only for the listed one. (Before this patch: both dropped, accepted: 0.)
• WHATSAPP_CLOUD_ALLOW_ALL_USERS=true opens intake via the new _open_dm_opted_in() override.
• Explicit WHATSAPP_CLOUD_DM_POLICY=allowlist + WHATSAPP_CLOUD_ALLOW_FROM still works unchanged.

Note

Either the docs/wizard should point at WHATSAPP_CLOUD_ALLOW_FROM/WHATSAPP_CLOUD_DM_POLICY, or (this PR) the adapter should honor the documented vars. Honoring the documented vars seems least-surprising for operators. Happy to also add a debug log when a DM is dropped by the intake gate if that's preferred — the silent drop was the hardest part to diagnose.