feat(feishu): support group chat allowlist

[lazydao]

Summary

Adds a Feishu/Lark group chat allowlist environment variable, FEISHU_GROUP_ALLOWED_CHATS, so operators can authorize all members of specific group chats without granting those users DM access or access from other groups.

Details

• Extends gateway authorization to recognize FEISHU_GROUP_ALLOWED_CHATS for group chat-scoped access.
• Includes wildcard support through the existing group chat allowlist behavior.
• Adds the env var to the Feishu plugin metadata and docs.
• Adds regression coverage for matching group, non-matching group, DM, and wildcard behavior.

Validation

• /home/will/.hermes/hermes-agent/.venv/bin/python -m pytest tests/gateway/test_feishu_bot_auth_bypass.py -q passed: 8 tests.
• /home/will/.hermes/hermes-agent/.venv/bin/python -m py_compile gateway/authz_mixin.py passed.
• git diff --check passed.

Note: scripts/run_tests.sh in the temporary worktree selected /home/will/.hermes/hermes-agent/venv, which does not have pytest; the validation above used the repo's working .venv interpreter explicitly while running from this branch's worktree.

[alt-glitch]

This was generated by AI during triage.

Competing PR for the same feature (FEISHU_GROUP_ALLOWED_CHATS) as two other OPEN PRs: #29709 (earliest, canonical) and #33715. This PR implements it in gateway/authz_mixin.py rather than the _is_user_authorized() maps in gateway/run.py — same goal, different code site. Not a duplicate; a maintainer should pick one of the three.

[teknium1]

Thanks for the focused implementation and regression coverage. This automated hermes-sweeper review is closing it because the proposed user-facing configuration mechanism conflicts with a standing project policy.

• AGENTS.md:102-106 requires non-secret behavioral settings to use config.yaml, not a new environment variable. FEISHU_GROUP_ALLOWED_CHATS controls authorization scope, so it is a behavioral access-policy setting.
• The PR's substantive change is the new FEISHU_GROUP_ALLOWED_CHATS surface in gateway/authz_mixin.py and the Feishu plugin/docs (52c4da0a7579f6cc00be74b61e0e7d6576cfedd3).
• A focused re-scope should add the needed config.yaml plumbing, building on Feishu's existing platforms.feishu.extra.group_rules configuration (plugins/platforms/feishu/adapter.py:1503-1522; website/docs/user-guide/messaging/feishu.md:491-529), rather than documenting another .env setting.

The competing-PR discussion is acknowledged; it does not change this policy-based decision.

---

Closed as not-planned per standing maintainer policy (env-var-for-config). This is a design-direction decision, not a code-quality judgment — see the Contribution Rubric in AGENTS.md for what the project is looking for. If you believe this policy was misapplied to your change, comment here and a maintainer will take a look.